Re: Shellshocker - Repository of "Shellshock" Proof of Concept Code

[Rob Fuller <jd.mubix () gmail com>]

Ladies and Gents, I'm the owner of the repo in question and would love
to fix any misgivings you have with the list. But as you are the
experts it would be awesome if you could help me understand which
parts exactly are incorrect, or what you think should be added to help
people better understand. I'll try to consolidate the statements in
this thread, but would greatly appreciate any pull requests or issues
posted to https://github.com/mubix/shellshocker-pocs/issues that could
help me with that process.


Thanks,

--
Rob Fuller | Mubix
Certified Checkbox Unchecker
Room362.com | Hak5.org


On Sun, Oct 5, 2014 at 10:55 AM, David A. Wheeler <dwheeler () dwheeler com> wrote:
> On Sun, 5 Oct 2014 17:44:15 +0400, Solar Designer <solar () openwall com> wrote:
> > .... Most non-expert people only need to know that they need either the
> > prefix/suffix patch included or function imports disabled, preferably in
> > a security update from their distro vendor.  This makes the individual
> > parser bugs, which got CVEs assigned, irrelevant.
> >
> > Here's the relevant test:
> > testfunc='() { echo bad; }' bash -c testfunc
>
> This is a MUCH better test for most people.  Hanno's test script is great for detail, but most people don't need the 
> detail.
>
> I'm putting that email in my timeline at http://www.dwheeler.com/essays/shellshock.html#timeline - this is an EASY 
> test people can directly use.
>
> ---  David A. Wheeler