Another ShellShock exploit in the wild

Re:Another ShellShock exploit in the wild by skuhn on Thursday September 25, 2014 @04:08PM (#8369454)

I haven't tried it, but that is the relevant line from the PHP C source. sendmail_cmd is a variable, so you're right, it will be expanded to whatever.

popen()'s man page says:

  FILE *popen(const char *command, const char *type);
  
  [..]
  
  The command argument is a pointer to a null-terminated
  string containing a shell command line. This command is
  passed to /bin/sh using the -c flag
  
  [..]

Which is where /bin/sh gets involved. PHP should be calling pipe/fork instead of popen IMO, I can't see the point in invoking a shell.

[ Parent | on HN ]

Re:Another ShellShock exploit in the wild by nitrogen on Friday September 26, 2014 @12:37AM (#8371349)

Which is where /bin/sh gets involved. PHP should be calling pipe/fork instead of popen IMO, I can't see the point in invoking a shell.

Ideally there would be something like a popenve() to simplify the process of opening the pipe(s) and passing arguments and environment.

There are also various other variations on the popen() concept, like my own popen3() implementations in C[0] (note that I'm not the only person to write a popen3; Python, Ruby, and probably other languages have their own).

However, I mimicked the real popen(), and my implementation uses /bin/sh as well. It would be easy to make a version of popen3() that accepts argument and environment arrays, but it would still be insecure if the environment was set to the calling process's environ pointer[1], and/or the command to be executed was a /bin/bash script.

[0] https://gist.github.com/nitrogenlogic/1022231#file-popen3_20... [1] http://linux.die.net/man/7/environ

[ Parent | on HN ]