oss-security - Re: Re: CVE-2014-6271: remote code execution through bash (3rd vulnerability)

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <542564CD.9090205@debian.org>
Date: Fri, 26 Sep 2014 14:06:21 +0100
From: Simon McVittie <smcv@...ian.org>
To: oss-security@...ts.openwall.com
Subject: Re: Re: CVE-2014-6271: remote code execution through
 bash (3rd vulnerability)

On 26/09/14 09:54, Mark R Bannister wrote:
> Patch every OS to clear the environment on setuid/setgid and live
> with a few other programs that might break?

Apache suexec, among other things, can't work if the environment is
cleared. It needs to pass the CGI environment variables through, and is
setuid itself.

Properly-written setuid components are often a necessary part of letting
unprivileged components benefit from privilege-separation (e.g. CGI
scripts running with less privilege than the web server, with neither
running as root). The problem is that not all setuid components are
properly-written.

> Tell everyone to stop using setuid/setgid now and forever?

Minimizing use of setuid/setgid, and making sure the setuid/setgid
things are suitably hardened, is a good idea. However, tools for
controlled privilege escalation (sudo, pkexec, Apache suexec) rely on
setuid in order to work. There's a reason the feature exists at all.

I still think a large part of the answer is "consider it to be a serious
bug when a setuid/setgid tool does non-trivial things without first
filtering its attacker-controlled environment through a whitelist".

If it needs to pass environment variables through to a child, this
pseudocode is a good pattern (AIUI, sudo does this):

        let saved_environ = copy of environ
        let environ = empty

        setenv(PATH = "/usr/bin:/bin")  # or some other safe value
        setenv(HOME = "/")
        # ... and repeat for a few other well-known variables that are
        # often relied on

        if saved_environ["LANG"] has a safe value {
                setenv(LANG = saved_environ["LANG"])
                # ... and repeat for a few other well-known variables
                # that can safely be passed-through if their values are
                # suitably constrained
        }

        parse options
        decide what to do
        do PAM authentication/authorization etc.
        drop privileges / set up privileges as necessary

        if configured to pass environment through {
                copy some or all of saved_environ back into environ
        }

        exec(child, child_args)

Regards,
    S

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.