Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sun, 5 Oct 2014 11:25:37 -0400
From: Rob Fuller <>
Subject: Re: Shellshocker - Repository of "Shellshock" Proof of
 Concept Code

Ladies and Gents, I'm the owner of the repo in question and would love
to fix any misgivings you have with the list. But as you are the
experts it would be awesome if you could help me understand which
parts exactly are incorrect, or what you think should be added to help
people better understand. I'll try to consolidate the statements in
this thread, but would greatly appreciate any pull requests or issues
posted to that could
help me with that process.


Rob Fuller | Mubix
Certified Checkbox Unchecker |

On Sun, Oct 5, 2014 at 10:55 AM, David A. Wheeler <> wrote:
> On Sun, 5 Oct 2014 17:44:15 +0400, Solar Designer <> wrote:
>> .... Most non-expert people only need to know that they need either the
>> prefix/suffix patch included or function imports disabled, preferably in
>> a security update from their distro vendor.  This makes the individual
>> parser bugs, which got CVEs assigned, irrelevant.
>> Here's the relevant test:
>> testfunc='() { echo bad; }' bash -c testfunc
> This is a MUCH better test for most people.  Hanno's test script is great for detail, but most people don't need the detail.
> I'm putting that email in my timeline at - this is an EASY test people can directly use.
> ---  David A. Wheeler

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.