[Libguestfs] Bash bug

I don't really consider these to be bugs in libguestfs, but a few places are affected by the infamous bash bug. * virt-edit passes the '-e' script to Perl using an environment variable, and runs Perl using the shell, so: $ virt-edit -a /tmp/fedora-20.img /etc/motd -e '() { :; } ; echo hello' hello Mitigating this is that you shouldn't really be passing untrusted Perl scripts to virt-edit in the first place, since Perl itself can do pretty much anything. * the virt-builder/virt-customize --edit flags are similarly affected: $ virt-customize --edit '/etc/motd:() { :; } ; echo hello' -a /tmp/fedora-20.img [ 0.0] Examining the guest ... [ 6.0] Setting a random seed [ 6.0] Editing: /etc/motd hello [ 6.0] Finishing off * guestfish 'edit' command, same as above * The guestfish 'event' command lets you specify an environment variable that is later passed to bash. * Probably most seriously, the library passes TERM from its environment through to the appliance, and thence through to the daemon, which of course runs shell commands all over the place. TERM may contain any characters *except* spaces, which may make this route impossible to exploit, although I wouldn't be sure. Anyway, best thing is to update bash. Rich. -- Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones Read my programming and virtualization blog: http://rwmj.wordpress.com virt-builder quickly builds VMs from scratch http://libguestfs.org/virt-builder.1.html