The question is: How big a problem is this? Looks pretty big to me.
With the shellshock bug it is possible to bypass the whitelist of known-harmless environment variables in sudo, as well as other routes to execution of code as high-privileged users. For example variables MAIL
and DISPLAY
are by default propagated by sudo in many configurations (last time I checked - I don't think the latest Debian does).
In the presence of Shellshock, if an unprivileged user, partially privileged user, or malware with unprivileged code-execution can supply any propagated environment variable whatsoever to a shell running as root, he can execute arbitrary code as root.
- User with limited
sudo
rights is malicious - User sets environment variable such as
MAIL
to shellshock exploit code - Any call to
popen
,system
orbash
by anysudo
'd command by such a user will now result in arbitrary code execution as root. - result is that any sudo rights at all become root access to the system - it does not matter how restricted his access was
Or:
- User gains access to unattended terminal of user with some sudo rights, or
- Malware gains code execution as an unprivileged user who has some sudo rights
- Malware/User sets propagated environment variable such as
MAIL
to shellshock exploit code - Any call to
popen
,system
orbash
by anysudo
'd command by such a user will now result in code execution as root. - Does not require knowledge of password - password can be entered later by the victim user after access has ceased.