Re^2: The importance of avoiding the shell

[ikegami]

I think ssh can specify the value for TERM, making ssh an attack vector if you can get it to execute sh/bash (directly or indirectly).

But the new vulnerability is worse because it can be *any* env var, and CGI will gladly populate env vars with values of the attacker's choice for him. Any CGI script that executes bash is a dead easy attack vector. Attackers have been scanning for a CPanel script that shells out.

[shmem]

I think ssh can specify the value for TERM, making ssh an attack vector if you can get it to execute sh/bash.

Right; simple test:

qwurx [shmem] ~ > env TERM='() { :;}; echo vulnerable' ssh localhost
...
Last login: Tue Sep 30 10:14:54 2014 from localhost
vulnerable
qwurx [shmem] ~ >