full-disclosure - bash vulnerability?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <42FDA72E.2040903@osrf.teamlimit.net>
Date: Sat Aug 13 13:28:08 2005
From: sharivegas at gmail.com (Shari Vegas)
Subject: bash vulnerability?

This vulnerability for right now should be classified as a zero-day local
shell exploit for bash. May want to let your other customers using
Linux/*BSD about this. Still looking for a fix to it at the moment, I
have my team on it. From here, it looks like doing a "ulimit -u 15"
should supress it, but I'm not quite sure for exactly how long, or the
effectiveness.

The string looks like this:

:-(){ :|:& };:

Nasty little shit.

--

Mail I sent my admin earlier after I heard about it. Anyone have just any idea what this is? And how to fix it?