Tag Info

New answers tagged

0

@Gilles is right. I think the results of this test might be interesting: I did a test with a very lame script: $ cat ./sudoset.bash #!/bin/bash-shellshock set To confirm, without sudo: $ export MAIL="() { :;} ; echo busted"; ./sudoset.bash | head -3 busted busted BASH=/bin/bash-shellshock (not sure why "busted" appears twice) With sudo: $ ...


3

Sudo blocks environment variables that might be bash function definitions (2004-11-11 env.c: strip exported bash functions from the environment), even if the variable name is whitelisted. That's why sudo isn't included in the list of common attack vectors for Shellshock. A bash script invoked by su to a restricted account can be an attack vector. But there ...



Top 50 recent answers are included