Re: Re: CVE-2014-6271: remote code execution through bash (3rd vulnerability)

[Giles Coochey <giles () coochey net>]

On 29/09/2014 14:07, Chet Ramey wrote:
> On 9/29/14, 8:55 AM, Giles Coochey wrote:
> > On 29/09/2014 12:17, Loganaden Velvindron wrote:
> > > HI Chet, As you are aware, a sixth security issue has been discovered.
> > > Due to the nature of the vulnerability, I believe that it's best to break
> > > backward compatibility as done by FreeBSD and NetBSD until a proper patch
> > > is developed. We are lucky to have security researchers reporting their
> > > findings publicly. What about others that don't ? I strongly believe that
> > > it's much safer to have it disabled, and have a complete and
> > > comprehensive audit of the source code, and then re-enable it.
> > Am I the only one who is wondering: Who is paying Chet to do this?
> Nobody is paying me to do this.
So, as a note to everybody suggesting a "complete and comprehensive 
audit of the source code", I think such suggestions be backed up with 
some supportive technical manpower or some generous donations to Chet!!! 
:-) ;-)

--
Regards,

Giles Coochey, CCNP, CCNA, CCNAS
NetSecSpec Ltd
+44 (0) 8444 780677
+44 (0) 7584 634135
http://www.coochey.net
http://www.netsecspec.co.uk
giles () coochey net

Attachment: smime.p7s
Description: S/MIME Cryptographic Signature