Re: Zsh - Multiple DoS Vulnerabilities

[Bart Schaefer <schaefer@xxxxxxxxxxxxxxxx>]

On Tue, May 14, 2019 at 2:25 PM Daniel Shahaf <d.s@xxxxxxxxxxxxxxxxxx> wrote:
>
> Stephane Chazelas wrote on Tue, 14 May 2019 18:11 +00:00:
> > IMO, from a security standpoint, it's not very useful to fuzz
> > "code" input provided to zsh, as anyway any "code" allows zsh to
> > run any arbitrary command (except for the restricted mode). In
> > other words, the "code" is generally not the attacker supplied
> > data.
>
> Sounds right.  There might be some corner case here

The other interesting case would be one where the zsh code enabled
privilege escalation, i.e., where the coder is the attacker and the
shell is the vector to a different security issue.  A zsh script to
exploit ZombieLoad, for example.