235 reputation
14
bio website
location
age
visits member for 2 years
seen yesterday

Oct
15
comment SSL3 “POODLE” Vulnerability
What about the forced/unsafe out of protocol downgrade to SSLv3? What are the software affected by that?
Oct
7
comment Shellshocking Webservers, does anyone know of an attack-vector other than Headers?
@thatguyfromoverthere, I'd agree it probably should, but apache doesn't (at least not in the versions I tried). That first line can contain anything, the first word is the method, the second the path and the rest, if any the protocol (SERVER_PROTOCOL defaults to HTTP/0.9 when not provided probably for compatibility with servers from the early 90s).
Oct
3
awarded  Yearling
Oct
3
comment When Shellshock was introduced, how bad was it **then**?
As was found later, the FIE was added in 1.03 in August 1989, so before the web.
Oct
3
comment Set-uid script wrappers, `system(3)` shellshock and Bash Function Import from Environment
When PATH is unset, it defaults to something, and that something depends on who does the path look up, and for GNU libc's exec*p for instance, it's :/bin:/usr/bin, so it looks for executables in the current directory first. Luckily, most shells set PATH on startup to something saner if it's not set. But if /path/to/script.sh's interpreter is not one of those, you're screwed. An empty environment can also be unsafe.
Oct
3
comment Shellshock plus sudo/su environment whitelist bypass - big problem?
D'oh. I stand corrected. How can they? That was one of the things the Bourne shell used to be bashed on in the 90s. That posh was modified (as it's based on pdksh which doesn't to something as silly) to do that doesn't make sense either.
Oct
3
revised Why “() { :;};”?
in practice, bash replaced the = with a space (that doesn't make much of a difference though).
Oct
3
comment When Shellshock was introduced, how bad was it **then**?
Some Unices still support setuid scripts. telnet, rlogin or rsh could and still can get you to a restricted command (and TERM is passed): the login shell of the target user. It's not unheard of to have public services exposed that way (even without authentication)
Oct
3
answered Shellshocking Webservers, does anyone know of an attack-vector other than Headers?
Oct
3
comment How to tell if someone else's site is vulnerable to Shellshock without hacking them?
You can have a look at clues as to what the operating system is though (like in the "Server" HTTP header or using nmap) to see if it's likely an EOL no-longer-supported system. Not a definitive answer but a hint in a direction or another.
Oct
3
suggested suggested edit on Why “() { :;};”?
Oct
3
comment Set-uid script wrappers, `system(3)` shellshock and Bash Function Import from Environment
@Ben, bash doesn't import functions when setuid. shellshock commonly doesn't provide a vector for local privilege escalation.
Oct
3
comment Set-uid script wrappers, `system(3)` shellshock and Bash Function Import from Environment
sudo only resets the whole environment when the env_reset setting is on (which is the default). Otherwise, it blacklists some variables (like those that affect many common tools like sh, ksh, bash, python...) and does some sanitizing based on content.
Oct
3
comment Set-uid script wrappers, `system(3)` shellshock and Bash Function Import from Environment
Not using execvp is no excuse for not sanitizing $PATH as whatever you execv (especially scripts) may rely on it for running other commands.
Oct
3
comment Set-uid script wrappers, `system(3)` shellshock and Bash Function Import from Environment
LOCPATH is cleared by the dynamic linker, but note that LANG/LANGUAGE/LC_* were vulnerable to CVE-2014-0475 in some contexts. Some other variables like DISPLAY, TERM, HOME, TZ, XAUTHORITY may be needed (but after sanitizing) depending on context.
Oct
3
awarded  Commentator
Oct
3
comment Set-uid script wrappers, `system(3)` shellshock and Bash Function Import from Environment
It's not the kernel that clears LD_PRELOAD (or LD_DEBUG, LD_LIBRARY_PATH, GCONV_MODULE_PATH, LOCPATH...), it's the dynamic linker (at least on GNU systems). The kernel has nothing to do with env vars except taking it from the execve system call and put it on the stack of the process.
Oct
3
revised Does shellshock produce a comprehensive local privilege escalation vector?
added 487 characters in body
Oct
2
comment Does shellshock produce a comprehensive local privilege escalation vector?
No, bash doesn't import functions when setuid/setgid and if called by something that sets the ruid to the euid without sanitizing the environment, you're screwed anyway.
Oct
2
answered Does shellshock produce a comprehensive local privilege escalation vector?