Date: Thu, 2 Oct 2014 01:15:51 -0700 From: Michal Zalewski <lcamtuf@...edump.cx> To: oss-security <oss-security@...ts.openwall.com> Cc: Shawn <citypw@...il.com> Subject: Re: more bash parser bugs (CVE-2014-6277, CVE-2014-6278) Nope. There are no CVEs assigned for general hardening (e.g., Florian's patch) and the ordering of CVE IDs isn't necessarily chronological (because larger vendors get their own ranges to allocate without consulting any central authority). In true chronological order, it went like this: * CVE-2014-6271 - original RCE found by Stephane. Fixed by bash43-025 and corresponding Sep 24 entries for other versions. * CVE-2014-7169 - file creation / token consumption bug found by Tavis. Fixed by bash43-026 & co (Sep 26) * CVE-2014-7186 - a probably no-sec-risk 10+ here-doc crash found by Florian and Todd. Fixed by bash43-028 & co (Oct 1). * CVE-2014-7187 - a non-crashing, probably no-sec-risk off-by-one found by Florian. Fixed by bash43-028 & co (Oct 1). * CVE-2014-6277 - uninitialized memory issue, almost certainly RCE found by me. No specific patch yet. * CVE-2014-6278 - command injection RCE found by me. No specific patch yet. *All* of these are mitigated by Florian's unofficial patch (http://www.openwall.com/lists/oss-security/2014/09/25/13) or its upstream version (bash43-027 & co, released on Sep 27). If you have that patch, there's no point in obsessing about the status of individual bugs, because they should no longer pose a security risk. And you don't have it, patch your system now instead of waiting for any additional patches for '77 and '78 =) /mz
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ