oss-sec mailing list archives

Re: Shellshock timeline (was: CVE-2014-6271: remote code execution through bash)

From: "David A. Wheeler" <dwheeler () dwheeler com>
Date: Sun, 05 Oct 2014 10:11:24 -0400 (EDT)

Everyone: Thank you VERY MUCH for your timeline corrections and additions on shellshock.

My updated document is here:
  http://www.dwheeler.com/essays/shellshock.html
The updated timeline is here:
  http://www.dwheeler.com/essays/shellshock.html#timeline

It also includes references to:
1. the *much* simpler vulnerability test posted by Solar Designer http://seclists.org/oss-sec/2014/q4/114
2. the more detailed test at https://raw.githubusercontent.com/hannob/bashcheck/master/bashcheck

--- David A. Wheeler

Current thread:

Shellshock timeline (was: CVE-2014-6271: remote code execution through bash) David A. Wheeler (Oct 03)
- Re: Shellshock timeline (was: CVE-2014-6271: remote code execution through bash) Kobrin, Eric (Oct 03)
  - Re: Shellshock timeline (was: CVE-2014-6271: remote code execution through bash) Stephane Chazelas (Oct 03)
    - Re: Shellshock timeline (was: CVE-2014-6271: remote code execution through bash) Kobrin, Eric (Oct 03)
    - Re: Shellshock timeline (was: CVE-2014-6271: remote code execution through bash) Riot (Oct 03)
    - Re: Shellshock timeline (was: CVE-2014-6271: remote code execution through bash) Riot (Oct 03)
    - Re: Shellshock timeline (was: CVE-2014-6271: remote code execution through bash) Stephane Chazelas (Oct 04)
    - Re: Shellshock timeline (was: CVE-2014-6271: remote code execution through bash) Hanno Böck (Oct 04)
    - Re: Shellshock timeline (was: CVE-2014-6271: remote code execution through bash) Steve Jones (Oct 04)
    - Re: Shellshock timeline (was: CVE-2014-6271: remote code execution through bash) Lance Davis (Oct 04)
    - Re: Shellshock timeline (was: CVE-2014-6271: remote code execution through bash) David A. Wheeler (Oct 05)
    - Re: Shellshock timeline (was: CVE-2014-6271: remote code execution through bash) Eric Blake (Oct 06)
- Re: Shellshock timeline Stephane Chazelas (Oct 03)
  - Re: Shellshock timeline Stephane Chazelas (Oct 03)
    - Stéphane Chazelas: How *DID* you find Shellshock? David A. Wheeler (Oct 08)
    - Re: Stéphane Chazelas: How *DID* you find Shellshock? stephane.chazelas (Oct 08)
- Re: Shellshock timeline (was: CVE-2014-6271: remote code execution through bash) Eric Blake (Oct 03)
  - Re: Shellshock timeline Eric Blake (Oct 03)
- <Possible follow-ups>
- Re: Shellshock timeline (was: CVE-2014-6271: remote code execution through bash) Riot (Oct 04)