3 ms·
This post claims that it is still not fixed and there is a 3rd case: http://seclists.org/oss-sec/2014/q3/741 http://seclists.org/oss-sec/2014/q3/741 http://se
by ck2 12y ago
This post claims that it is still not fixed and there is a 3rd case:
http://seclists.org/oss-sec/2014/q3/741 http://seclists.org/oss-sec/2014/q3/741
http://seclists.org/oss-sec/2014/q3/711 http://seclists.org/oss-sec/2014/q3/711
Was that before the second patch was sent out last night?
Or can we expect a third patch this weekend?
- tokenizerrr 12y agoThe posts you linked are just referring to the actual "feature", not another exploit. This feature is being able to define functions from enviroment variables, and requires the attacker to be able to control both the enviroment variable name & value. If an attack can do this, they can also set LD_PRELOAD and a whole host of other nasty enviroment variables.