bash ã®è„†å¼±æ€§ "Shell Shock" ã®ã‚ã£ã¡ã‚ƒç´°ã‹ã„話 (CVE-2014-6271) - ã‚‚ã‚ãš blog※(2014/10/1 追記) 脆弱性ã®ç•ªå·ã‚’誤ã£ã¦ CVE-2014-6721 ã¨è¡¨è¨˜ã—ã¦ã—ã¾ã£ã¦ã„ã¾ã—㟠æ£ã—ã㯠"CVE-2014-6271" ã§ã™ 失礼致ã—ã¾ã—㟠※(2014/10/7 追記) 2014/10/7 14:00時点㧠Shell Shock ã¸ã®ä¿®æ£ãƒ‘ッãƒã¯6個 公開ã•ã‚Œã¦ã„ã¾ã™ æ—¢ã«å¯¾å¿œæ¸ˆã¿ã®ã‚·ã‚¹ãƒ†ãƒ ã§ã‚‚パッãƒã®æ¼ã‚ŒãŒãªã„ã‹æ³¨æ„ã—ã¦ãã ã•ã„ シェルã«è„†å¼±æ€§ãŒè¦‹ã¤ã‹ã£ãŸã‚‰ã—ã„ã§ã™ ã“ã®ã‚³ãƒžãƒ³ãƒ‰ã‚’実行ã™ã‚‹ã¨è„†å¼±æ€§ãŒã‚ã‚‹ãƒãƒ¼ã‚¸ãƒ§ãƒ³ã‹ã®ãƒã‚§ãƒƒã‚¯ãŒã§ãるよã†ã§ã™ $ env x='() { :;}; echo vulnerable' bash -c "echo this is a test" 以下ã®ã‚ˆã†ã«è¡¨ç¤ºã•ã‚ŒãŸã‚‰ã‚¢ã‚¦ãƒˆã§ã™ vulnerable this is a test ã©ã†ã‚„らã€ã“ã®ã‚³ãƒžãƒ³ãƒ‰ãŒæ£å¸¸ã«å®Ÿè¡Œã§ãã‚‹ã¨ã„ã†ã®ãŒã“ã®è„†å¼±æ€§ã®æ£ä½“らã—ã〠echo vuln
ã‚‚ã†å…¥åŠ›å€¤æ¤œè¨¼ã¯ã‚»ã‚ュリティ対ç–ã¨ã—㦠*ã‚ã¦ã«ã—ãªã„* よã†ã«ã—よã†
github ã® mass assignment 脆弱性ãŒçªã‹ã‚ŒãŸä»¶
{{#tags}}- {{label}}
{{/tags}}