[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 2 Oct 2014 01:15:51 -0700
From: Michal Zalewski <lcamtuf@...edump.cx>
To: oss-security <oss-security@...ts.openwall.com>
Cc: Shawn <citypw@...il.com>
Subject: Re: more bash parser bugs (CVE-2014-6277, CVE-2014-6278)
Nope. There are no CVEs assigned for general hardening (e.g.,
Florian's patch) and the ordering of CVE IDs isn't necessarily
chronological (because larger vendors get their own ranges to allocate
without consulting any central authority).
In true chronological order, it went like this:
* CVE-2014-6271 - original RCE found by Stephane. Fixed by bash43-025
and corresponding Sep 24 entries for other versions.
* CVE-2014-7169 - file creation / token consumption bug found by
Tavis. Fixed by bash43-026 & co (Sep 26)
* CVE-2014-7186 - a probably no-sec-risk 10+ here-doc crash found by
Florian and Todd. Fixed by bash43-028 & co (Oct 1).
* CVE-2014-7187 - a non-crashing, probably no-sec-risk off-by-one
found by Florian. Fixed by bash43-028 & co (Oct 1).
* CVE-2014-6277 - uninitialized memory issue, almost certainly RCE
found by me. No specific patch yet.
* CVE-2014-6278 - command injection RCE found by me. No specific patch yet.
*All* of these are mitigated by Florian's unofficial patch
(http://www.openwall.com/lists/oss-security/2014/09/25/13) or its
upstream version (bash43-027 & co, released on Sep 27). If you have
that patch, there's no point in obsessing about the status of
individual bugs, because they should no longer pose a security risk.
And you don't have it, patch your system now instead of waiting for
any additional patches for '77 and '78 =)
/mz
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
