Re: CVE-2014-6271: remote code execution through bash

[Chet Ramey <chet.ramey () case edu>]

On 9/24/14, 6:27 PM, Solar Designer wrote:
> On Wed, Sep 24, 2014 at 12:08:46PM -0400, Chet Ramey wrote:
> > On 9/24/14, 11:16 AM, Solar Designer wrote:
> >
> > > I see no good workaround. 
> >
> > You're correct; there is not a good workaround.  Since there are publicly
> > available patches for all bash versions back 15 years or so, though, the
> > best path forward is to apply those as quickly as possible.
>
> Thank You for providing those patches!  It is rare for an upstream
> author to provide security fix backports going this far back, and it is
> really helpful in this case.

Thanks for the kind words.  In this spirit, I've attached a patch for
bash-2.05b, since I've been told that there are still systems running it
out there.

Chet


-- 
``The lyf so short, the craft so long to lerne.'' - Chaucer
                 ``Ars longa, vita brevis'' - Hippocrates
Chet Ramey, ITS, CWRU    chet () case edu    http://cnswww.cns.cwru.edu/~chet/

Attachment: funcdef-import-2.05b.patch
Description: