On 25 September 2014 22:38, Ted Roche <[email protected]> wrote: > Twitter was all aflutter about it yesterday; the distros were great about > implementing the patch and getting it out overnight. > > Realize that many things run bash you may not be aware of, and patching > them can be tricky. Obviously, the biggest threat is web-exposed machines > that have features that shell out -- many many PHP, Perl, Python and Ruby > apps use some form of Exec() calls to talk to the underlying OS, just as we > would use RUN/! in VFP.
This one is scary: https://www.trustedsec.com/september-2014/shellshock-dhcp-rce-proof-concept/ You run a DHCP server. When a DHCP client connects you return malicious data that Bash uses to run executables (e.g. setting default routes). -- Paul _______________________________________________ Post Messages to: [email protected] Subscription Maintenance: http://mail.leafe.com/mailman/listinfo/profox OT-free version of this list: http://mail.leafe.com/mailman/listinfo/profoxtech Searchable Archive: http://leafe.com/archives/search/profox This message: http://leafe.com/archives/byMID/profox/CADwx0+L9CMYgu5gmLo3eoGC=otwanosuwjm0dxj0mtdagtl...@mail.gmail.com ** All postings, unless explicitly stated otherwise, are the opinions of the author, and do not constitute legal or medical advice. This statement is added to the messages for those lawyers who are too stupid to see the obvious.
