diff options
| author | Chet Ramey <chet.ramey@case.edu> | 2019-11-25 02:05:27 +0100 |
|---|---|---|
| committer | Vasyl Gello <vasek.gello@gmail.com> | 2019-11-26 20:24:31 +0000 |
| commit | 5418a65b77cf33e078fdb64da876204fd0b3103c (patch) | |
| tree | fbfd48b9942546f2f7bd02a687c0176f88a2c51c | |
| parent | 5dab935d200c0ec6d18a5fbf5159dd6a1dc1f473 (diff) | |
| download | android_external_bash-lineage-15.1.tar.gz android_external_bash-lineage-15.1.tar.bz2 android_external_bash-lineage-15.1.zip | |
bash: BASH_CMD is writable in restricted bash shellslineage-15.1
rbash in Bash before 4.4-beta2 did not prevent the shell user from modifying
BASH_CMDS, thus allowing the user to execute any command with the permissions
of the shell.
Fixes CVE-2019-9924
Change-Id: I1276b0920e28edd2096c3e9a346ce1d79304a66b
| -rw-r--r-- | variables.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/variables.c b/variables.c index f816ffe..b059b1a 100644 --- a/variables.c +++ b/variables.c @@ -1601,6 +1601,13 @@ assign_hashcmd (self, value, ind, key) arrayind_t ind; char *key; { +#if defined (RESTRICTED_SHELL) + if (restricted && strchr (value, '/')) + { + sh_restricted (value); + return (SHELL_VAR *)NULL; + } +#endif phash_insert (key, value, 0, 0); return (build_hashcmd (self)); } |