Git bash shellshock vulnerability

Question

I have installed Git for Windows with bash shell support. Is it vulnerable to ShellShock?

Refs:

How is your question different from the question you linked? — CodesInChaos, Sep 26 '14 at 14:54

score 2 · Answer 1 · answered Sep 26 '14 at 16:36

2

The article you linked to clearly stated that it was vulnerable. However, it's pretty hard to leverage "shell shock" in "BASH" on Windows for git. You're still restricted to the users permissions, and their git code repository on their file system.

Additionally, there are far fewer attack vectors that exploit shell shock on Windows than on their *nix counterparts. I'd be gobsmacked if I saw a windows process invoke a bash shell.

answered Sep 26 '14 at 16:36

theCowardlyFrench

381
2
6

1

You are also restricted to the user user invoking bash on *nix. The big difference is that while it's used everywhere on *nix, on Windows it won't be called too much on (some cygwin process). – Ángel Sep 26 '14 at 16:40
Could you clarify "restricted to the user user invoking bash"? And to be fair, if you have cygwin installed you will have a whole other instance of BASH on your system, along side the git bash for windows. With the functionality of cygwin, we start to see a lot more danger with running a BASH that is vulnerable to shell shock since the entire file system is accessible to us now. – theCowardlyFrench Sep 26 '14 at 16:59

score 1 · Answer 2 · edited Mar 17 '17 at 13:14

1

Pretty sure it is. Check with Is there a short command to test if my server is secure against the shellshock bash bug?

Although on windows it is more difficult that an attacker is able to set an environment variable to a malicious value and that bash later gets executed with it.

edited Mar 17 '17 at 13:14

Community

1

answered Sep 26 '14 at 16:34

Ángel

18,188
3
26
63

Git bash shellshock vulnerability

2 Answers2