Posted in Security Operations
Securing Internet-Critical Software: How We Could Have Backdoored Bash
George B. — Senior Software Engineer
The Savannah disclosure is a good case for reviewing where validated data gets reused: an RFC-valid email address became shell syntax in a GPG helper, opening a path to Bash maintainer impersonation. I’d bring this into code review as a question about which interpreter receives a value next—“already validated” tells you very little without that context.
https://www.hacktron.ai/blog/hacking-gnu-savannah
4 reactions · 1 comments
Comments
Ben N.: great article george. Thank you for sharing