oss-sec mailing list archives
Re: Qualys Security Advisory - The Stack Clash
From: Qualys Security Advisory <qsa () qualys com>
Date: Wed, 21 Jun 2017 14:28:35 -0700
Hi Solar, all, On Tue, Jun 20, 2017 at 03:22:04PM +0200, Solar Designer wrote:
Qualys, I suggest that, like you did with the Sudo exploit, you publish your Stack Clash exploits in here as soon as third-party exploits of comparable functionality appear, or next Tuesday, whichever is earlier.
We have discussed this internally, and we will first publish the Stack Clash exploits and proofs-of-concepts that we sent to the distros@ and linux-distros@ lists, plus our Linux ld.so exploit for amd64, and our Solaris rsh exploit. We will do so next Tuesday, but we will publish our Linux exploits and proofs-of-concept if and only if Fedora updates are ready by then, our NetBSD proof-of-concept if and only if NetBSD patches are ready by then, and our FreeBSD proofs-of-concept if and only if FreeBSD patches are ready by then. If someone happens to know of another major distribution that has not published patches and updates yet, please let us all know by replying here to oss-security. Thank you very much! With best regards, -- the Qualys Security Advisory team
Current thread:
- Qualys Security Advisory - The Stack Clash Qualys Security Advisory (Jun 19)
- Re: Qualys Security Advisory - The Stack Clash kseifried () redhat com (Jun 19)
- Re: Qualys Security Advisory - The Stack Clash Daniel Micay (Jun 19)
- Re: Qualys Security Advisory - The Stack Clash Marcus Meissner (Jun 19)
- Re: Qualys Security Advisory - The Stack Clash Solar Designer (Jun 19)
- Re: Qualys Security Advisory - The Stack Clash Solar Designer (Jun 20)
- Re: Qualys Security Advisory - The Stack Clash Qualys Security Advisory (Jun 21)
- Re: Qualys Security Advisory - The Stack Clash nospam (Jun 21)
- Re: Re: Qualys Security Advisory - The Stack Clash Franz Pletz (Jun 21)
- Re: Qualys Security Advisory - The Stack Clash Solar Designer (Jun 25)
- Re: Qualys Security Advisory - The Stack Clash Qualys Security Advisory (Jun 28)
- Re: Qualys Security Advisory - The Stack Clash Daniel Micay (Jun 19)
- Re: Qualys Security Advisory - The Stack Clash kseifried () redhat com (Jun 19)
- Re: Qualys Security Advisory - The Stack Clash Josh Bressers (Jun 21)
- Re: Qualys Security Advisory - The Stack Clash Solar Designer (Jun 21)
- Re: Qualys Security Advisory - The Stack Clash Stuart Henderson (Jun 21)
- Re: Qualys Security Advisory - The Stack Clash kseifried () redhat com (Jun 21)
- Re: Qualys Security Advisory - The Stack Clash Qualys Security Advisory (Jun 21)
- Re: Qualys Security Advisory - The Stack Clash Jeff Law (Jun 21)