Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 29 Sep 2014 15:19:06 +0100
From: Giles Coochey <giles@...chey.net>
To: chet.ramey@...e.edu, oss-security@...ts.openwall.com
Subject: Re: Re: CVE-2014-6271: remote code execution through
 bash (3rd vulnerability)

On 29/09/2014 14:07, Chet Ramey wrote:
> On 9/29/14, 8:55 AM, Giles Coochey wrote:
>> On 29/09/2014 12:17, Loganaden Velvindron wrote:
>>> HI Chet, As you are aware, a sixth security issue has been discovered.
>>> Due to the nature of the vulnerability, I believe that it's best to break
>>> backward compatibility as done by FreeBSD and NetBSD until a proper patch
>>> is developed. We are lucky to have security researchers reporting their
>>> findings publicly. What about others that don't ? I strongly believe that
>>> it's much safer to have it disabled, and have a complete and
>>> comprehensive audit of the source code, and then re-enable it.
>> Am I the only one who is wondering: Who is paying Chet to do this?
> Nobody is paying me to do this.
>
So, as a note to everybody suggesting a "complete and comprehensive 
audit of the source code", I think such suggestions be backed up with 
some supportive technical manpower or some generous donations to Chet!!! 
:-) ;-)

-- 
Regards,

Giles Coochey, CCNP, CCNA, CCNAS
NetSecSpec Ltd
+44 (0) 8444 780677
+44 (0) 7584 634135
http://www.coochey.net
http://www.netsecspec.co.uk
giles@...chey.net



Download attachment "smime.p7s" of type "application/pkcs7-signature" (6454 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.