Re: Bash-4.3 Official Patch 25 Bug 896776 - (CVE-2014-6271)

[Alexandre FERRIEUX - SOFT/LAN]

On 26/09/2014 08:23, Ralf Naegele wrote:
> Hello Eduardo,
>
> I haven't installed the patched bash yet. I called it in the source
> directory after compiling, it with ./bash so I think this should start the
> patched bash.

You started ./bash as the parent reading the offending line, but did you also 
modify it so that ./bash appears inside ?

    env x='() { :;}; echo vulnerable' ./bash -c "echo this is a test"


This is important since the bug occurs in the child, at init time (within 
shell_initialize_variables)

-Alex