Date: Mon, 29 Sep 2014 11:26:34 +0200 From: n j <nino80@gmail.com> To: "freebsd-security@freebsd.org FreeBSD-security" <freebsd-security@freebsd.org> Subject: Re: Bash ShellShock bug(s) Message-ID: <CALf6cgb_HQXMUFo108RiEiKu0wV2F9bircH1DYwEB4=VjtXShw@mail.gmail.com> In-Reply-To: <7B489747-0FF8-4081-A001-7A510C3C6FA1@patpro.net> References: <2423691411974542@web12j.yandex.ru> <B5F07349-45ED-4B38-892A-2F7F4A25C085@patpro.net> <1771201411976082@web22o.yandex.ru> <7B489747-0FF8-4081-A001-7A510C3C6FA1@patpro.net>
next in thread | previous in thread | raw e-mail | index | archive | help
Hi,
On Mon, Sep 29, 2014 at 9:55 AM, Patrick Proniewski <patpro@patpro.net>
wrote:
>
> On 29 sept. 2014, at 09:34, =D0=9A=D1=83=D0=BB=D0=B5=D1=88=D0=BE=D0=B2 =
=D0=90=D0=BB=D0=B5=D0=BA=D1=81=D0=B5=D0=B9 <rndfax@yandex.ru> wrote:
>
> > Right. Okay then, here it is:
> >
> > # pkg remove bash
> > ... change 'bash' to 'sh' in bashcheck ...
> > # sh bashcheck
> > Not vulnerable to CVE-2014-6271 (original shellshock)
> > Not vulnerable to CVE-2014-7169 (taviso bug)
> > Not vulnerable to CVE-2014-7186 (redir_stack bug)
> > Vulnerable to CVE-2014-7187 (nessted loops off by one)
> > Variable function parser inactive, likely safe from unknown parser bugs
> >
> > So, there is no bash on my system anymore, but script says it has one
> vulnerability.
> > Is it actually vulnerability or it's me who must take a good sleep? :)
>
> This is odd. As far as I know, no one reported sh as being vulnerable to
> CVE-2014-7187. But may be it's only on FreeBSD... I don't have an answer =
to
> that.
>
I'd say the test is not relevant for sh. The line that tests for
CVE-2014-7187 uses {1..200} construct which is not understood by sh.
E.g.
sh$ for i in {1..5}; do echo -n $i; done
{1..5}
bash$ for i in {1..5}; do echo -n $i; done
12345
Br,
--=20
Nino
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?CALf6cgb_HQXMUFo108RiEiKu0wV2F9bircH1DYwEB4=VjtXShw>