Bash Path Embedded Code Execution Vulnerability
BID:119
Info
Bash Path Embedded Code Execution Vulnerability
| Bugtraq ID: | 119 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | Yes |
| Published: | Apr 20 1999 12:00AM |
| Updated: | Apr 20 1999 12:00AM |
| Credit: | This bug was made public by Shadow <[email protected]>. |
| Vulnerable: |
GNU GNU bash 1.14 |
| Not Vulnerable: |
GNU GNU bash 2.3 GNU GNU bash 2.2 GNU GNU bash 2.1 GNU GNU bash 2.0 |
Discussion
Bash Path Embedded Code Execution Vulnerability
A vulnerability in bash may allow inadvertently running commands embedded in the path to the currently working directory.
If an unsuspecting user enters a directory created by some malicious user with embedded commands, and their prompt (PS1) contains '\w' or '\W', and the prompt is displayed the commands will be executed. The vulnerability is in the parsing of the '\w' and '\W' escape codes.
As the prompt must be displayed unattended shell scripts are not vulnerable.
A vulnerability in bash may allow inadvertently running commands embedded in the path to the currently working directory.
If an unsuspecting user enters a directory created by some malicious user with embedded commands, and their prompt (PS1) contains '\w' or '\W', and the prompt is displayed the commands will be executed. The vulnerability is in the parsing of the '\w' and '\W' escape codes.
As the prompt must be displayed unattended shell scripts are not vulnerable.
References
Bash Path Embedded Code Execution Vulnerability
References:
References: