Re: Healing the bash fork

[Sebastian Krahmer <krahmer () suse de>]

On Tue, Sep 30, 2014 at 01:50:40PM +0100, Mark R Bannister wrote:
> > I discuss the setuid/setgid vulnerability at the following site,> including demonstrating how Florian's 
> > prefix/suffix patch provides
> > no protection:>
> > http://technicalprose.blogspot.co.uk/2014/09/shellshock-bug-third-vulnerability.html
>
> Please can we have a separate CVE for the setuid/setgid bash exploit?  I think this attack vector deserves to be 
> tracked properly, and we need to be clear on when and if someone chooses to provide a fix for it.

"innocuous looking setuid program" made my day ;)

We should take care not to blame all and everything to bash.

Sebastian

-- 

~ perl self.pl
~ $_='print"\$_=\47$_\47;eval"';eval
~ krahmer () suse de - SuSE Security Team