Executive brief
The Bash command shell, a fundamental component of Linux and Unix-like operating systems, incorrectly handles a specific character (value 255) as a command separator. This flaw could allow a local user to execute unauthorized commands by tricking the system into running hidden instructions. Such an exploit could lead to unauthorized data access or system instability.
Technical details
A vulnerability exists in GNU Bash where the character with the decimal value 255 (0xFF) is incorrectly interpreted as a command separator, similar to a semicolon or newline. This issue stems from improper input validation or character encoding handling within the shell's command parser. A local attacker could exploit this by crafting input containing this character to execute arbitrary commands with the privileges of the user running the shell. This is particularly dangerous in environments where Bash scripts process untrusted input or where the shell is used as a restricted interface. The vulnerability is addressed in later versions of Bash.
Affected products
- GNU Bash
Timeline
- 1996-10-08: disclosed