Re: demonstration of CVE-2014-7186 ShellShock vulnerability

2014-09-27 Thread Jean-Christian de Rivaz
Le 27. 09. 14 07:53, Eric Blake a écrit : [...] So, to FULLY test whether you are still vulnerable to ShellShock, we must come up with a test that proves that NO possible function body assigned to a valid shell variable name can EVER cause bash to invoke the parser without your consent. For tha

Re: Bash 2.05b patch for 896776 - (CVE-2014-6271) ?

2014-09-26 Thread Jean-Christian de Rivaz
Le 26. 09. 14 18:55, Steve Simmons a écrit : These patches build and run without problem in our initial bash2 tests. However, I notice that both the version number reported by ./bash --version and doing ./bash followed by echo $BASH_VERSION both report "2.05b.0(1)-release". All versions that I'

Re: Bash 2.05b patch for 896776 - (CVE-2014-6271) ?

2014-09-26 Thread Jean-Christian de Rivaz
Le 26. 09. 14 16:47, Chet Ramey a écrit : On 9/26/14, 4:53 AM, Jean-Christian de Rivaz wrote: Hello, While this can seem completely obsolete, I still have machines running bash 2.05b (Debian etch). I worry about upgrading to bash 3.x because of some backward compatibility issue. It there any

Bash 2.05b patch for 896776 - (CVE-2014-6271) ?

2014-09-26 Thread Jean-Christian de Rivaz
Hello, While this can seem completely obsolete, I still have machines running bash 2.05b (Debian etch). I worry about upgrading to bash 3.x because of some backward compatibility issue. It there any reason why there was no patch for bash 2.05b ? The test command below show that the bug also af