diff options
| author | Chet Ramey <chet.ramey@case.edu> | 2019-11-25 02:05:27 +0100 |
|---|---|---|
| committer | Vasyl Gello <vasek.gello@gmail.com> | 2019-11-26 20:25:05 +0000 |
| commit | b629f8ea175433430f745a3e71022c3db2b41767 (patch) | |
| tree | 55818c7fed2b9d44fc1c867110ea25f65a969af7 | |
| parent | 813aebfbf90b8ecd36bfa387170afe50799acc49 (diff) | |
| download | android_external_bash-lineage-16.0.tar.gz android_external_bash-lineage-16.0.tar.bz2 android_external_bash-lineage-16.0.zip | |
bash: BASH_CMD is writable in restricted bash shellslineage-16.0
rbash in Bash before 4.4-beta2 did not prevent the shell user from modifying
BASH_CMDS, thus allowing the user to execute any command with the permissions
of the shell.
Fixes CVE-2019-9924
Change-Id: I1276b0920e28edd2096c3e9a346ce1d79304a66b
| -rw-r--r-- | variables.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/variables.c b/variables.c index f816ffe..b059b1a 100644 --- a/variables.c +++ b/variables.c @@ -1601,6 +1601,13 @@ assign_hashcmd (self, value, ind, key) arrayind_t ind; char *key; { +#if defined (RESTRICTED_SHELL) + if (restricted && strchr (value, '/')) + { + sh_restricted (value); + return (SHELL_VAR *)NULL; + } +#endif phash_insert (key, value, 0, 0); return (build_hashcmd (self)); } |