[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAP-=ew0CMq-eo9uXEWP8whquXwiePruzpKhjj640PyWh8t8CuQ@mail.gmail.com>
Date: Sun, 5 Oct 2014 11:25:37 -0400
From: Rob Fuller <jd.mubix@...il.com>
To: oss-security@...ts.openwall.com
Subject: Re: Shellshocker - Repository of "Shellshock" Proof of
Concept Code
Ladies and Gents, I'm the owner of the repo in question and would love
to fix any misgivings you have with the list. But as you are the
experts it would be awesome if you could help me understand which
parts exactly are incorrect, or what you think should be added to help
people better understand. I'll try to consolidate the statements in
this thread, but would greatly appreciate any pull requests or issues
posted to https://github.com/mubix/shellshocker-pocs/issues that could
help me with that process.
Thanks,
--
Rob Fuller | Mubix
Certified Checkbox Unchecker
Room362.com | Hak5.org
On Sun, Oct 5, 2014 at 10:55 AM, David A. Wheeler <dwheeler@...eeler.com> wrote:
> On Sun, 5 Oct 2014 17:44:15 +0400, Solar Designer <solar@...nwall.com> wrote:
>> .... Most non-expert people only need to know that they need either the
>> prefix/suffix patch included or function imports disabled, preferably in
>> a security update from their distro vendor. This makes the individual
>> parser bugs, which got CVEs assigned, irrelevant.
>>
>> Here's the relevant test:
>> testfunc='() { echo bad; }' bash -c testfunc
>
> This is a MUCH better test for most people. Hanno's test script is great for detail, but most people don't need the detail.
>
> I'm putting that email in my timeline at http://www.dwheeler.com/essays/shellshock.html#timeline - this is an EASY test people can directly use.
>
> --- David A. Wheeler
>
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
