Re: [CentOS] Bash still vulnerable

2014-10-09 Thread Johnny Hughes
On 10/09/2014 07:00 AM, Johnny Hughes wrote: > On 10/09/2014 06:48 AM, Kai Schaetzl wrote: >> I noticed this as well but did some homework ;-) >> https://bugzilla.redhat.com/show_bug.cgi?id=1147189 >> https://access.redhat.com/security/cve/CVE-2014-6277 >> >> If I understand it correctly they think

Re: [CentOS] Bash still vulnerable

2014-10-09 Thread Johnny Hughes
On 10/09/2014 06:48 AM, Kai Schaetzl wrote: > I noticed this as well but did some homework ;-) > https://bugzilla.redhat.com/show_bug.cgi?id=1147189 > https://access.redhat.com/security/cve/CVE-2014-6277 > > If I understand it correctly they think it's not exploitable anymore. > Still think it sh

Re: [CentOS] Bash still vulnerable

2014-10-09 Thread Kai Schaetzl
I noticed this as well but did some homework ;-) https://bugzilla.redhat.com/show_bug.cgi?id=1147189 https://access.redhat.com/security/cve/CVE-2014-6277 If I understand it correctly they think it's not exploitable anymore. Still think it should get patched immediately as there is an upstream pa

Re: [CentOS] Bash still vulnerable

2014-10-09 Thread Karanbir Singh
On 10/09/2014 12:26 PM, Lars Hecking wrote: > > According to the vulnerability test script from shellshocker.net, the latest > bash versions on CentOS5 and CentOS6, 3.2-33.el5_11.4 and 4.1.2-15.el6_5.2, > resp., are still vulnerable to CVE-2014-6277. In fact, on CentOS6, abrtd will > send you

[CentOS] Bash still vulnerable

2014-10-09 Thread Lars Hecking
According to the vulnerability test script from shellshocker.net, the latest bash versions on CentOS5 and CentOS6, 3.2-33.el5_11.4 and 4.1.2-15.el6_5.2, resp., are still vulnerable to CVE-2014-6277. In fact, on CentOS6, abrtd will send you a nice report about it. Does anyone know if upstream i