Re: ksh, csh same vulnerability as bash

2014-10-08 Thread Giancarlo Razzolini
On 08-10-2014 17:14, David Coppa wrote: > On Wed, Oct 8, 2014 at 9:47 PM, Giancarlo Razzolini > wrote: >> On 08-10-2014 15:03, Артур Истомин wrote: >>> How affiliate mtier with OpenBSD? Is it safe method/source for update? >>> Who they are? >> It has been pointed to me that one of the

Re: ksh, csh same vulnerability as bash

2014-10-08 Thread David Coppa
On Wed, Oct 8, 2014 at 9:47 PM, Giancarlo Razzolini wrote: > On 08-10-2014 15:03, Артур Истомин wrote: >> How affiliate mtier with OpenBSD? Is it safe method/source for update? >> Who they are? > It has been pointed to me that one of the ports maintainer/developer, is > associated with them. not

Re: ksh, csh same vulnerability as bash

2014-10-08 Thread Giancarlo Razzolini
On 08-10-2014 15:03, Артур Истомин wrote: > How affiliate mtier with OpenBSD? Is it safe method/source for update? > Who they are? It has been pointed to me that one of the ports maintainer/developer, is associated with them. I've been using since 5.4, and had no issues so far. Their pa

Re: ksh, csh same vulnerability as bash

2014-10-08 Thread Артур Истомин
On Wed, Oct 08, 2014 at 09:39:39AM +, Stuart Henderson wrote: > On 2014-10-08, Jason Adams wrote: > > On 09/29/2014 05:00 AM, Peter Hessler wrote: > >> You tested bash. All 3 shells are behaving correctly by passing the env > >> variable to the bash command you are running. the bash command

Re: ksh, csh same vulnerability as bash

2014-10-08 Thread Stuart Henderson
On 2014-10-08, Jason Adams wrote: > On 09/29/2014 05:00 AM, Peter Hessler wrote: >> You tested bash. All 3 shells are behaving correctly by passing the env >> variable to the bash command you are running. the bash command you are >> running is behaving incorrectly by parsing the variable as a fu

Re: ksh, csh same vulnerability as bash

2014-10-08 Thread Dennis Davis
On Wed, 8 Oct 2014, Gregor Best wrote: > From: Gregor Best > To: Jason Adams > Cc: misc@openbsd.org > Date: Wed, 8 Oct 2014 08:57:53 > Subject: Re: ksh, csh same vulnerability as bash > > On Tue, Oct 07, 2014 at 10:05:57PM -0700, Jason Adams wrote: > > [...] > >

Re: ksh, csh same vulnerability as bash

2014-10-08 Thread Gregor Best
On Tue, Oct 07, 2014 at 10:05:57PM -0700, Jason Adams wrote: > [...] > So the question is, for those of us that have added the bash package, > why is bash still vulnerable after all these weeks, when everyone else has > fixed > their bash packages? > > Just checked for updated pkg, today, and its

Re: ksh, csh same vulnerability as bash

2014-10-07 Thread Maurice McCarthy
mtier have had at least two updates of bash that I know of. Regards

Re: ksh, csh same vulnerability as bash

2014-10-07 Thread Eric Furman
On Wed, Oct 8, 2014, at 01:05 AM, Jason Adams wrote: > On 09/29/2014 05:00 AM, Peter Hessler wrote: > > You tested bash. All 3 shells are behaving correctly by passing the env > > variable to the bash command you are running. the bash command you are > > running is behaving incorrectly by parsing

Re: ksh, csh same vulnerability as bash

2014-10-07 Thread Jason Adams
On 09/29/2014 05:00 AM, Peter Hessler wrote: > You tested bash. All 3 shells are behaving correctly by passing the env > variable to the bash command you are running. the bash command you are > running is behaving incorrectly by parsing the variable as a function. So the question is, for those o

Re: ksh, csh same vulnerability as bash

2014-09-29 Thread Peter Hessler
You tested bash. All 3 shells are behaving correctly by passing the env variable to the bash command you are running. the bash command you are running is behaving incorrectly by parsing the variable as a function. To test ksh/csh, you need to run a different command. On 2014 Sep 29 (Mon) at 03

Re: ksh, csh same vulnerability as bash

2014-09-29 Thread Markus Hennecke
Am 29.09.2014 12:53, schrieb Bogdan Andu: the bug in bash shell discovered last day also seems to be present in ksh and csh. ksh is known to be the default shell in OpenBSD. the following piece of shell code executes succesffuly on both ksh and csh (besides bash of course): ksh: $ env VAR='()

ksh, csh same vulnerability as bash

2014-09-29 Thread Bogdan Andu
Hello list, the bug in bash shell discovered last day also seems to be present in ksh and csh. ksh is known to be the default shell in OpenBSD. the following piece of shell code executes succesffuly on both ksh and csh (besides bash of course): ksh: $ env VAR='() { :;}; echo Bash is vulnerable!