[Bug 14442] Shell command injection vulnerability in mount.cifs

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



https://bugzilla.samba.org/show_bug.cgi?id=14442

--- Comment #6 from Vadim Lebedev <vadim@xxxxxxxxxx> ---
(In reply to Lancelot Bogard from comment #3)
I confirm, even if systemd-ask-password is shell script
the arguments is not evaluated as command.
Example:
vadim@sys76:/tmp$ cat ./test.sh
#!/bin/bash

prompt=$1
echo prompt is $prompt

vadim@sys76:/tmp$ set -x; ./test.sh  '$(id)'; set +x
+ ./test.sh '$(id)'
prompt is $(id)
+ set +x
vadim@sys76:/tmp$ 


So it seems the patch fixes the problem definitively

-- 
You are receiving this mail because:
You are the QA Contact for the bug.



[Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux