full-disclosure - bash vulnerability?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <ac0d138666b6854a3290c7cec6232b93@tatooine.homelinux.net>
Date: Sun Aug 14 14:15:17 2005
From: nobody at tatooine.homelinux.net (starwars)
Subject: bash vulnerability?

>
>
> Wernfried Haas wrote:
>
> > assuming you actually meant
> > :(){ :|:& };: (which can be harmful if no limits are set)?

   It should be noted that according to the limits man page, "By default no quotas are imposed on 'root'. In fact, there is no way to impose limits via this procedure to root-equiv accounts (account with UID 0)."

"ulimit -u 15"

  only works temporarily for that user unless issed in a startup script. "echo '* U15' > /etc/limits" 

(as root of course) is a permanent solution (root is still unaffected).

-secjunky