Re: Re: CVE-2014-6271: remote code execution through bash (3rd vulnerability)

[Giles Coochey <giles.coochey () netsecspec co uk>]

On 29/09/2014 12:17, Loganaden Velvindron wrote:
> HI Chet, As you are aware, a sixth security issue has been discovered. 
> Due to the nature of the vulnerability, I believe that it's best to 
> break backward compatibility as done by FreeBSD and NetBSD until a 
> proper patch is developed. We are lucky to have security researchers 
> reporting their findings publicly. What about others that don't ? I 
> strongly believe that it's much safer to have it disabled, and have a 
> complete and comprehensive audit of the source code, and then 
> re-enable it.

Am I the only one who is wondering: Who is paying Chet to do this?

--
Regards,

Giles Coochey, CCNP, CCNA, CCNAS
NetSecSpec Ltd
+44 (0) 8444 780677
+44 (0) 7584 634135
http://www.netsecspec.co.uk
giles.coochey () netsecspec co uk

Attachment: smime.p7s
Description: S/MIME Cryptographic Signature