Re: Malicious translation file can cause buffer overflow

2015-04-30 Thread Pádraig Brady
On 30/04/15 23:08, Trammell Hudson wrote: > Configuration Information [Automatically generated, do not change]: > Machine: x86_64 > OS: linux-gnu > Compiler: gcc > Compilation CFLAGS: -DPROGRAM='bash' -DCONF_HOSTTYPE='x86_64' > -DCONF_OSTYPE='linux-gnu' -DCONF_MACHTYPE='x86_64-unknown-linux-gnu'

Re: Malicious translation file can cause buffer overflow

2015-04-30 Thread Chet Ramey
On 4/30/15 6:08 PM, Trammell Hudson wrote: > Bash Version: 4.3 > Patch Level: 30 > Release Status: release > > > Description: > The gettext translated messages for "Done", "Done(%d)" and "Exit %d" > in jobs.c are copied to a static allocated buffer. A user could set the > LANGUAGE variable to p

Re: bash buffer overflow in handling locale environment variables

2015-04-30 Thread Chet Ramey
On 4/30/15 4:59 PM, Chet Ramey wrote: >> Fix: >> Use strncpy() in place of strcpy() in lib/sh/unicode.c: >> >> --- /tmp/bash-4.3.30/lib/sh/unicode.c 2014-01-30 21:47:19.0 + >> +++ ./bash-4.3.30/lib/sh/unicode.c 2015-04-30 18:03:42.300340729 + >> @@ -78,7 +78,8 @@ >>s =

Malicious translation file can cause buffer overflow

2015-04-30 Thread Trammell Hudson
Configuration Information [Automatically generated, do not change]: Machine: x86_64 OS: linux-gnu Compiler: gcc Compilation CFLAGS: -DPROGRAM='bash' -DCONF_HOSTTYPE='x86_64' -DCONF_OSTYPE='linux-gnu' -DCONF_MACHTYPE='x86_64-unknown-linux-gnu' -DCONF_VENDOR='unknown' -DLOCALEDIR='/tmp/local/share

Re: bash -c reads /etc/profile despite --noprofile

2015-04-30 Thread Trammell Hudson
On Thu, Apr 30, 2015 at 05:07:15PM -0400, Chet Ramey wrote: > On 4/30/15 2:37 PM, Trammell Hudson wrote: > That function is only executed if you have BASH_ENV or ENV set, and neither > of those should be subject to the setting of --noprofile. I suspect you > have BASH_ENV=/etc/profile in your envi

Re: bash -c reads /etc/profile despite --noprofile

2015-04-30 Thread Chet Ramey
On 4/30/15 2:37 PM, Trammell Hudson wrote: > Bash Version: 4.3 > Patch Level: 30 > Release Status: release > > Description: > User and system profile files are executed even despite the --noprofile > or --norc flag to bash since execute_env_file() does not check the > no_profile global variable.

Re: bash buffer overflow in handling locale environment variables

2015-04-30 Thread Chet Ramey
On 4/30/15 2:13 PM, Trammell Hudson wrote: > Bash Version: 4.3 > Patch Level: 30 > Release Status: release > > Description: > Overly long LC_ALL or LC_CTYPE variables can cause a buffer overflow > in converting 32-bit unicode characters. The stub_charset() function > calls strcpy() into a static

Re: bash buffer overflow in handling locale environment variables

2015-04-30 Thread Stephane Chazelas
2015-04-30 18:13:48 +, Trammell Hudson: [...] > Overly long LC_ALL or LC_CTYPE variables can cause a buffer overflow > in converting 32-bit unicode characters. The stub_charset() function > calls strcpy() into a static 40-byte buffer for the charset, which > can be overflowed if the charset po

bash -c reads /etc/profile despite --noprofile

2015-04-30 Thread Trammell Hudson
Configuration Information [Automatically generated, do not change]: Machine: x86_64 OS: linux-gnu Compiler: gcc Compilation CFLAGS: -DPROGRAM='bash' -DCONF_HOSTTYPE='x86_64' -DCONF_OSTYPE='linux-gnu' -DCONF_MACHTYPE='x86_64-unknown-linux-gnu' -DCONF_VENDOR='unknown' -DLOCALEDIR='/usr/local/share

bash buffer overflow in handling locale environment variables

2015-04-30 Thread Trammell Hudson
Configuration Information [Automatically generated, do not change]: Machine: x86_64 OS: linux-gnu Compiler: gcc Compilation CFLAGS: -DPROGRAM='bash' -DCONF_HOSTTYPE='x86_64' -DCONF_OSTYPE='linux-gnu' -DCONF_MACHTYPE='x86_64-unknown-linux-gnu' -DCONF_VENDOR='unknown' -DLOCALEDIR='/usr/local/share

Re: bash --debugger on a script with no arguments

2015-04-30 Thread Rocky Bernstein
Thanks. On Thu, Apr 30, 2015 at 9:27 AM, Chet Ramey wrote: > On 4/29/15 10:31 PM, Rocky Bernstein wrote: > > > $ ./bash --debugger -i /tmp/foo.sh > > hi > > > > $ ./bash --debugger /tmp/foo.sh > > bash debugger, bashdb, release 4.3-0.91 > > > > Copyright 2002, 2003, 2004, 2006-2012, 2014 Rock

Re: bash --debugger on a script with no arguments

2015-04-30 Thread Chet Ramey
On 4/29/15 10:31 PM, Rocky Bernstein wrote: > $ ./bash --debugger -i /tmp/foo.sh > hi > > $ ./bash --debugger /tmp/foo.sh > bash debugger, bashdb, release 4.3-0.91 > > Copyright 2002, 2003, 2004, 2006-2012, 2014 Rocky Bernstein > This is free software, covered by the GNU General Public Licens