| Description | By default, Debian links /bin/sh to /bin/dash as its default shell. This shell is vulnerable to set-uid exploits as described here:
http://blog.cmpxchg8b.com/2013/08/security-debianisms.html
(Sample uses VMWare as an example.)
Fix:
- Change default shell to link to bash:
a. Issue the command: dpkg-reconfigure dash.
b. Tell it no, and let it switch to bash as the default shell.
c. Profit.
- Patch dash to act like bash:
http://thread.gmane.org/gmane.comp.shells.dash/841 |
|---|
| Additional Information | Initially marking as private- not earth-shattering, but it's a possible priv. escalation on current systems, please feel free to switch status to public.
Yes, I know we're all running as root anyway, and the attack surface is small, but I'm erring on the side of caution. |
|---|
