oss-security - Re: Thoughts on Shellshock and beyond

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Tue, 07 Oct 2014 07:59:05 -0400
From: "David A. Wheeler" <dwheeler@...eeler.com>
To: oss-security@...ts.openwall.com,Hanno Böck <hanno@...eck.de>
Subject: Re: Thoughts on Shellshock and beyond

> * Heartbleed is an out of bounds memory read. Well understood and yes,
  it should be possible to implement mitigations against these kinds of
  things.

It is not only possible, I have already posted a list of ways to find Heartbleed:
http://www.dwheeler.com/essays/heartbleed.html

I think identifying specific ways to counter classes of vulnerabilities is really important.

> What class of bug is Shellshock? "Weird feature invented in
  pre-Internet era"? How do you conquer this class of bugs?

I am still struggling with this one.  I am trying to create that list here:
http://www.dwheeler.com/essays/shellshock.html#detect-or-prevent

But to be honest, that list is pretty pathetic. This is a challenging class of vulnerability to detect or prevent ahead of time. Ideas would be very welcome.

--- David A.Wheeler

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.