Re: Re: Re: CVE-2014-6271: remote code execution through bash (3rd vulnerability)

[Bryan Drewery <bdrewery () FreeBSD org>]

On 9/26/2014 9:13 AM, Christos Zoulas wrote:
> On Sep 26,  1:47pm, john.haxby () oracle com (John Haxby) wrote:
> -- Subject: Re: [oss-security] Re: CVE-2014-6271: remote code execution throu
>
> | It's not so much the known attacks -- redefining ls, unset, command,
> | typeset, declare, etc -- it's the future parser bugs that we don't yet
> | know about.
> | 
> | A friend of mine said this could be a vulnerability gift that keeps on
> | giving.
>
> I think that at this point the conservative approach is best, so
> until the bash author figures what the best solution is, the feature
> is disabled by default for NetBSD. It is not wise to expose bash's
> parser to the internet and then debug it live while being attacked.
>
> christos

FreeBSD has taken a similar approach. We have used Christos' patch and
disabled the feature by default.

https://svnweb.freebsd.org/changeset/ports/369341

Regards,
Bryan Drewery

Attachment: signature.asc
Description: OpenPGP digital signature