Even without the immediate code-execution problem of Shellshock trailing commands, to what extent does the feature of bash importing functions from the environment give rise to a comprehensive privilege escalation vulnerability?
To be clear, there are many setuid programs, and some of them will directly or indirectly call scripts, or use the
system(3) call, which on most Linuxes goes through
bash. The question is to what extent, assuming systems have such
setuid binaries installed, this feature of
bash allows local privilege escalation.
- For example if calling a script does it allow overriding of built-ins? If so can this give rise to an escalation of privilege in combination with a
setuidexecutable and the
system(3)call, by overriding e.g.
cdor something innocuous?
- Would such an escalation vector require a script to be called (in which case one could potentially override
lsor any command used by the script which didn't use a full path)?
- Are imported functions potentially used at any point by the normal execution path of
/bin/sh -c ARGUMENTSeven when the first argument is not a script?
- Could you simply give an environment variable the same name as the first argument to
- If so does that mean that every call to
system(3)by a setuid executable, on a system where
/bin/shis bash, is a privilege escalation vector?