Re: Shellshocker - Repository of "Shellshock" Proof of Concept Code

["David A. Wheeler" <dwheeler () dwheeler com>]

On Sun, 5 Oct 2014 17:44:15 +0400, Solar Designer <solar () openwall com> wrote:
> .... Most non-expert people only need to know that they need either the
> prefix/suffix patch included or function imports disabled, preferably in
> a security update from their distro vendor.  This makes the individual
> parser bugs, which got CVEs assigned, irrelevant.
>
> Here's the relevant test:
> testfunc='() { echo bad; }' bash -c testfunc

This is a MUCH better test for most people.  Hanno's test script is great for detail, but most people don't need the 
detail.

I'm putting that email in my timeline at http://www.dwheeler.com/essays/shellshock.html#timeline - this is an EASY test 
people can directly use.

---  David A. Wheeler