Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Thu, 25 Sep 2014 07:50:26 -0700
From: Reed Black <>
Subject: CVE-2014-6271 first patch and remote exploit via CGI

In the press, there are contrary statements about the initial patches[1]
posted by Florian Weimer. A user on Twitter posted[2] that the patch was
incomplete. There is agreement on that much. Where I see different
responses is on whether the first patch can still be exploited remotely via
the CGI vector outlined in Florian's initial post, and what damage can
still be done. I haven't seen a proof of concept yet, but I also haven't
seen a trusted voice give a definitive statement that it can't be abused.

Could anyone lay out what's still possible for a remote attacker via CGI
with only the first patch applied?


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.