[arch-general] A good time to switch to dash as /bin/sh?

Chester Wisniewski chetw at zuzax.com
Fri Sep 26 18:26:18 UTC 2014

The flaw is not patched correctly. Tavis Ormandy has shown it to be still exploitable. 


On 26 September 2014 11:23:59 GMT-07:00, Guus Snijders <gsnijders at gmail.com> wrote:
>Op 26 sep. 2014 16:34 schreef "Doug Newgard" <scimmia at archlinux.info>:
>> Instead of theorizing that "many" will do this, give a real world
>of where this happens and would have reduced the attack surface of the
>in question.
>One of the very few examples that sound reasonable,  is dhclient.
>Apparently,  that can be readily used for this bug to be exploited.
>like more of problem with dhclient,  though.
>I agree that there's a lot of fud out there about this bug; once found
>perhaps: cve assigned), the patches came quickly, so that actually
>quite good for bash!
>Switching /bin/sh to dash has been discussed before and we can spend a
>of e-mails on that, but as usual it's up to devs to implement it as
>or not.
>Just my E0, 02
>Mvg,  Guus

More information about the arch-general mailing list