Re: Bash vuln. can affect OpenSSH

[Date Prev] [Date Next] [Thread Prev] [Thread Next] [Date Index] [Thread Index]

 



On 24 September 2014 17:34, mancha <mancha1@xxxxxxxx> wrote:
> This is a friendly heads up regarding a recently-disclosed Bash
> vulnerability that can impact behavior in the context of OpenSSH
> connections (CVE-2014-6271).
>
> In sum, the vulnerability relates to a flaw in Bash's evaluation of
> environment variables such that attackers can use specially-crafted
> environment variables for code injection [1].
>
> For example, server-side OpenSSH restrictions might be bypassed with
> maliciously-crafted TERM or SSH_ORIGINAL_COMMAND variables.
>
> Bash has issued patches to fix this issue:
>
> http://ftp.gnu.org/pub/gnu/bash/bash-3.0-patches/bash30-017
> http://ftp.gnu.org/pub/gnu/bash/bash-3.1-patches/bash31-018
> http://ftp.gnu.org/pub/gnu/bash/bash-3.2-patches/bash32-052
> http://ftp.gnu.org/pub/gnu/bash/bash-4.0-patches/bash40-039
> http://ftp.gnu.org/pub/gnu/bash/bash-4.1-patches/bash41-012
> http://ftp.gnu.org/pub/gnu/bash/bash-4.2-patches/bash42-048
> http://ftp.gnu.org/pub/gnu/bash/bash-4.3-patches/bash43-025

A better fix is to switch to /usr/bin/ksh (AT&T ksh93) - it has been
designed and written with security in mind and has better automated
testing coverage than bash (which is a shame, but then the UNIX
enterprise is ruled by ksh93, not bash).

Lionel
_______________________________________________
openssh-unix-dev mailing list
openssh-unix-dev@xxxxxxxxxxx
https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev




[Date Prev] [Date Next] [Thread Prev] [Thread Next] [Date Index] [Thread Index]

[Index of Archives]     [Linux ARM Kernel]     [Linux ARM]     [Linux Omap]     [Fedora ARM]     [IETF Annouce]     [Security]     [Bugtraq]     [Linux]     [Linux OMAP]     [Linux MIPS]     [ECOS]     [Asterisk Internet PBX]     [Linux API]

  Powered by Linux