Re: Bash Blues.

> uk2sec /bin/bash Advisory

Interesting. Logged in via ssh to a red hat 7.3 and an 8.0 system (both are completely up to date) doing that command immediately logs me out (bash falls down badly). Other then that the system is fine, no weird load/etc. For a quick moment bash spikes, but 2.5% cpu usage on a 600 mhz cyrix processor is not exactly scary ditto for memory, 1.2% out of 248 megs (256 - 8 for the built in video) is not worrying. No resource limits are placed on bash via ulimit or the session via pam limits so it's not booting me out because of that.

CPU states: 2.5% user, 2.3% system, 0.0% nice, 95.0% idle Mem: 247516K av, 239088K used, 8428K free, 0K shrd, 61180K buff

Swap:  262072K av,   14456K used,  247616K free                  109576K
cached
  PID USER     PRI  NI  SIZE  RSS SHARE STAT %CPU %MEM   TIME COMMAND
  370 seifried  16   0  3112 3112  1096 R     2.5  1.2   0:00 bash
  769 postfix   15   0  1256 1104  1000 S     0.7  0.4  13:52 qmgr
  366 seifried  15   0  1064 1064   820 R     0.7  0.4   0:00 top
  606 root      15   0  1356 1272  1188 S     0.1  0.5   0:47 sshd

On Solaris with bash from sunfreeware (I think):

$ /usr/local/bin/bash
bash-2.05$ /usr/local/bin/bash --version GNU bash, version 2.05.0(1)-release (sparc-sun-solaris2.8) Copyright 2000 Free Software Foundation, Inc. bash-2.05$ uname -a
SunOS sparkplug 5.8 Generic_108528-15 sun4u sparc SUNW,Ultra-1 bash-2.05$ `perl -e 'print "*/*" x 2338'` Segmentation Fault - core dumped

takes a few seconds but then it seg faults. Who knows, maybe it is exploitable.

Kurt Seifried, kurt@seifried.org
A15B BEE5 B391 B9AD B0EF
AEB0 AD63 0B4E AD56 E574
http://seifried.org/security/ Received on Fri Feb 14 11:42:13 2003

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek