234 reputation
15
bio website
location
age
visits member for 2 years, 1 month
seen yesterday

Oct
15
comment SSL3 “POODLE” Vulnerability
What about the forced/unsafe out of protocol downgrade to SSLv3? What are the software affected by that?
Oct
7
comment Shellshocking Webservers, does anyone know of an attack-vector other than Headers?
@thatguyfromoverthere, I'd agree it probably should, but apache doesn't (at least not in the versions I tried). That first line can contain anything, the first word is the method, the second the path and the rest, if any the protocol (SERVER_PROTOCOL defaults to HTTP/0.9 when not provided probably for compatibility with servers from the early 90s).
Oct
3
comment When Shellshock was introduced, how bad was it **then**?
As was found later, the FIE was added in 1.03 in August 1989, so before the web.
Oct
3
comment Set-uid script wrappers, `system(3)` shellshock and Bash Function Import from Environment
When PATH is unset, it defaults to something, and that something depends on who does the path look up, and for GNU libc's exec*p for instance, it's :/bin:/usr/bin, so it looks for executables in the current directory first. Luckily, most shells set PATH on startup to something saner if it's not set. But if /path/to/script.sh's interpreter is not one of those, you're screwed. An empty environment can also be unsafe.
Oct
3
comment Shellshock plus sudo/su environment whitelist bypass - big problem?
D'oh. I stand corrected. How can they? That was one of the things the Bourne shell used to be bashed on in the 90s. That posh was modified (as it's based on pdksh which doesn't to something as silly) to do that doesn't make sense either.
Oct
3
comment When Shellshock was introduced, how bad was it **then**?
Some Unices still support setuid scripts. telnet, rlogin or rsh could and still can get you to a restricted command (and TERM is passed): the login shell of the target user. It's not unheard of to have public services exposed that way (even without authentication)
Oct
3
comment How to tell if someone else's site is vulnerable to Shellshock without hacking them?
You can have a look at clues as to what the operating system is though (like in the "Server" HTTP header or using nmap) to see if it's likely an EOL no-longer-supported system. Not a definitive answer but a hint in a direction or another.
Oct
3
comment Set-uid script wrappers, `system(3)` shellshock and Bash Function Import from Environment
@Ben, bash doesn't import functions when setuid. shellshock commonly doesn't provide a vector for local privilege escalation.
Oct
3
comment Set-uid script wrappers, `system(3)` shellshock and Bash Function Import from Environment
sudo only resets the whole environment when the env_reset setting is on (which is the default). Otherwise, it blacklists some variables (like those that affect many common tools like sh, ksh, bash, python...) and does some sanitizing based on content.
Oct
3
comment Set-uid script wrappers, `system(3)` shellshock and Bash Function Import from Environment
Not using execvp is no excuse for not sanitizing $PATH as whatever you execv (especially scripts) may rely on it for running other commands.
Oct
3
comment Set-uid script wrappers, `system(3)` shellshock and Bash Function Import from Environment
LOCPATH is cleared by the dynamic linker, but note that LANG/LANGUAGE/LC_* were vulnerable to CVE-2014-0475 in some contexts. Some other variables like DISPLAY, TERM, HOME, TZ, XAUTHORITY may be needed (but after sanitizing) depending on context.
Oct
3
comment Set-uid script wrappers, `system(3)` shellshock and Bash Function Import from Environment
It's not the kernel that clears LD_PRELOAD (or LD_DEBUG, LD_LIBRARY_PATH, GCONV_MODULE_PATH, LOCPATH...), it's the dynamic linker (at least on GNU systems). The kernel has nothing to do with env vars except taking it from the execve system call and put it on the stack of the process.
Oct
2
comment Does shellshock produce a comprehensive local privilege escalation vector?
No, bash doesn't import functions when setuid/setgid and if called by something that sets the ruid to the euid without sanitizing the environment, you're screwed anyway.
Sep
3
comment Unix execute permission can be easily bypassed. Is it superfluous, or what's the intention behind it?
Note that shells (and execvp(), env, xargs, find -exec...) are meant to execute executable text files with no #! with sh. Actually that's the only way to execute scripts that is specified by POSIX and the Unix specification. Note that on Linux, . is still in front of the default PATH you get (for execvp()) when the PATH env var is not set.
Mar
4
comment How can I protect myself from this kind of clipboard abuse?
That safe-paste zsh plugin is safe with recent versions of xterm (since 292) in its default configuration since xterm now discards most control characters (including ESC). Note that it only works for the zsh prompt, not for other applications (though some applications like vim could also be extended to do something similar)
Mar
4
comment How can I protect myself from this kind of clipboard abuse?
With "+p, that assumes a version of vim built with X support, and that vim has access to the X display that holds the relevant X selection (for instance, it wouldn't work after a ssh (without -X/-Y)).
Mar
4
comment How can I protect myself from this kind of clipboard abuse?
It seems it's vim, not xterm that turns C0 9B to 1B.
Mar
2
comment How can I protect myself from this kind of clipboard abuse?
Note that xterm already removes all ASCII ctrl (0x0 to 0x31) except \b (unfortunately), \r, \n and \t (unless you tell it not to with the allowPasteControls resource).
Jan
31
comment Why do we ask for a user's existing password when changing their password?
Why do you say it's different from Unix? That's exactly what Gnome (and probably KDE and OS/X as well) do with their key rings and/or encrypted directories (as PAM modules).
Nov
21
comment What's the secure way to change UNIX permissions on a harcoded file often?
See the O_NOFOLLOW flag to open(2) as well (on FreeBSD and Linux at least) to fail if the file is the symlink and avoid having to check for race conditions.