This is a friendly heads up regarding a recently-disclosed Bash vulnerability that can impact behavior in the context of OpenSSH connections (CVE-2014-6271). In sum, the vulnerability relates to a flaw in Bash's evaluation of environment variables such that attackers can use specially-crafted environment variables for code injection [1]. For example, server-side OpenSSH restrictions might be bypassed with maliciously-crafted TERM or SSH_ORIGINAL_COMMAND variables. Bash has issued patches to fix this issue: http://ftp.gnu.org/pub/gnu/bash/bash-3.0-patches/bash30-017 http://ftp.gnu.org/pub/gnu/bash/bash-3.1-patches/bash31-018 http://ftp.gnu.org/pub/gnu/bash/bash-3.2-patches/bash32-052 http://ftp.gnu.org/pub/gnu/bash/bash-4.0-patches/bash40-039 http://ftp.gnu.org/pub/gnu/bash/bash-4.1-patches/bash41-012 http://ftp.gnu.org/pub/gnu/bash/bash-4.2-patches/bash42-048 http://ftp.gnu.org/pub/gnu/bash/bash-4.3-patches/bash43-025 --mancha [1] https://securityblog.redhat.com/2014/09/24/bash-specially-crafted-environment-variables-code-injection-attack/ -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 819 bytes Desc: not available URL: <http://lists.mindrot.org/pipermail/openssh-unix-dev/attachments/20140924/49a88df6/attachment.bin>
On 24 September 2014 17:34, mancha <mancha1 at zoho.com> wrote:> This is a friendly heads up regarding a recently-disclosed Bash > vulnerability that can impact behavior in the context of OpenSSH > connections (CVE-2014-6271). > > In sum, the vulnerability relates to a flaw in Bash's evaluation of > environment variables such that attackers can use specially-crafted > environment variables for code injection [1]. > > For example, server-side OpenSSH restrictions might be bypassed with > maliciously-crafted TERM or SSH_ORIGINAL_COMMAND variables. > > Bash has issued patches to fix this issue: > > http://ftp.gnu.org/pub/gnu/bash/bash-3.0-patches/bash30-017 > http://ftp.gnu.org/pub/gnu/bash/bash-3.1-patches/bash31-018 > http://ftp.gnu.org/pub/gnu/bash/bash-3.2-patches/bash32-052 > http://ftp.gnu.org/pub/gnu/bash/bash-4.0-patches/bash40-039 > http://ftp.gnu.org/pub/gnu/bash/bash-4.1-patches/bash41-012 > http://ftp.gnu.org/pub/gnu/bash/bash-4.2-patches/bash42-048 > http://ftp.gnu.org/pub/gnu/bash/bash-4.3-patches/bash43-025A better fix is to switch to /usr/bin/ksh (AT&T ksh93) - it has been designed and written with security in mind and has better automated testing coverage than bash (which is a shame, but then the UNIX enterprise is ruled by ksh93, not bash). Lionel