Re: version string can cause overflow and affect eip/rip (needs length check in version string)

[Chet Ramey]

On 9/26/14, 3:13 AM, Johan Nestaas wrote:
> This isn't nearly as important as shellshock or whatever you want to call
> it, but I found this while glancing at the source and the latest patch.
> It's a funny little bug that I doubt could ever be useful for malicious
> reasons, unless you can determine an address to jump to that is comprised
> of all hex characters 30-39 (digits) due to the regex check on the version
> string, and also if the "attacker" could set a version string.
> 
> Still, a bad version string in a configure shouldn't allow someone to jump
> to an arbitrary address in memory. Might be a good idea to add a length
> check in configure or make.

If you want to do this to yourself, why should bash stop you?

Chet

-- 
``The lyf so short, the craft so long to lerne.'' - Chaucer
                 ``Ars longa, vita brevis'' - Hippocrates
Chet Ramey, ITS, CWRU    chet@case.edu    http://cnswww.cns.cwru.edu/~chet/