[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 26 Sep 2014 15:52:01 -0500
From: Bryan Drewery <bdrewery@...eBSD.org>
To: oss-security@...ts.openwall.com, chet.ramey@...e.edu
CC: Christos Zoulas <christos@...las.com>
Subject: Re: Re: Re: CVE-2014-6271: remote code execution through
bash (3rd vulnerability)
On 9/26/2014 9:13 AM, Christos Zoulas wrote:
> On Sep 26, 1:47pm, john.haxby@...cle.com (John Haxby) wrote:
> -- Subject: Re: [oss-security] Re: CVE-2014-6271: remote code execution throu
>
> | It's not so much the known attacks -- redefining ls, unset, command,
> | typeset, declare, etc -- it's the future parser bugs that we don't yet
> | know about.
> |
> | A friend of mine said this could be a vulnerability gift that keeps on
> | giving.
>
> I think that at this point the conservative approach is best, so
> until the bash author figures what the best solution is, the feature
> is disabled by default for NetBSD. It is not wise to expose bash's
> parser to the internet and then debug it live while being attacked.
>
> christos
>
FreeBSD has taken a similar approach. We have used Christos' patch and
disabled the feature by default.
https://svnweb.freebsd.org/changeset/ports/369341
Regards,
Bryan Drewery
Download attachment "signature.asc" of type "application/pgp-signature" (489 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
