Re: zsh seems to be vulnerable to CVE-2014-6271: remote code execution through bash

[Jérémie Roquet <arkanosis@xxxxxxxxx>]

Hi,

2014-09-24 16:45 GMT+02:00 İsmail Dönmez <ismail@xxxxxxxxx>:
> According to the vulnerability test in
> https://securityblog.redhat.com/2014/09/24/bash-specially-crafted-environment-variables-code-injection-attack/
>
> [~]> echo $ZSH_VERSION
> 5.0.6
>
> [~]> env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
> vulnerable
> this is a test

If I understand well, this test only proves that your version of
*bash* is vulnerable

$ env x='() { :;}; echo vulnerable' zsh -c "echo this is a test"
this is a test

Looks like zsh is not.

Best regards,

-- 
Jérémie