[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAESArwmSU5Yv8K=X52UhR5gmw_ZYNakk1OSBO4soZjEBm2X4Ww@mail.gmail.com>
Date: Thu, 25 Sep 2014 07:50:26 -0700
From: Reed Black <reed@...afeword.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2014-6271 first patch and remote exploit via CGI
In the press, there are contrary statements about the initial patches[1]
posted by Florian Weimer. A user on Twitter posted[2] that the patch was
incomplete. There is agreement on that much. Where I see different
responses is on whether the first patch can still be exploited remotely via
the CGI vector outlined in Florian's initial post, and what damage can
still be done. I haven't seen a proof of concept yet, but I also haven't
seen a trusted voice give a definitive statement that it can't be abused.
Could anyone lay out what's still possible for a remote attacker via CGI
with only the first patch applied?
[1] http://seclists.org/oss-sec/2014/q3/650
[2] http://www.openwall.com/lists/oss-security/2014/09/24/33
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
