Date: Thu, 25 Sep 2014 07:50:26 -0700 From: Reed Black <reed@...afeword.org> To: oss-security@...ts.openwall.com Subject: CVE-2014-6271 first patch and remote exploit via CGI In the press, there are contrary statements about the initial patches posted by Florian Weimer. A user on Twitter posted that the patch was incomplete. There is agreement on that much. Where I see different responses is on whether the first patch can still be exploited remotely via the CGI vector outlined in Florian's initial post, and what damage can still be done. I haven't seen a proof of concept yet, but I also haven't seen a trusted voice give a definitive statement that it can't be abused. Could anyone lay out what's still possible for a remote attacker via CGI with only the first patch applied?  http://seclists.org/oss-sec/2014/q3/650  http://www.openwall.com/lists/oss-security/2014/09/24/33
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.