K.S. Bhaskar on 26 Sep 2014 10:27:05 -0700


[Date Prev] [Date Next] [Thread Prev] [Thread Next] [Date Index] [Thread Index]

Re: [PLUG] 'Shellshock' Bug Spells Trouble for Web Security

http://blog.malwaremustdie.org/ discusses some exploits, but the details are beyond my cursory reading skills.

Regards
-- Bhaskar

On Fri, Sep 26, 2014 at 1:19 PM, Matt Mossholder <matt@mossholder.com> wrote:
On Fri, Sep 26, 2014 at 1:00 PM, Keith C. Perry <kperry@daotechnologies.com> wrote:
Fred,

What are you envisioning as the attack vector from the client point of view?  Is the concern that an infected DHCP server could craft a IP OFFER or ACK packet back to your client with an exploit?

~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~
Keith C. Perry, MS E.E.
Owner, DAO Technologies LLC
(O) +1.215.525.4165 x2033
(M) +1.215.432.5167
www.daotechnologies.com


Keith,
     That is exactly what can happen. Come DHCP clients hand off information from the DHCP server to scripts for processing. In these cases, you could get whacked by a bad DHCP server.

     --Matt 

___________________________________________________________________________
Philadelphia Linux Users Group         --        http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion  --   http://lists.phillylinux.org/mailman/listinfo/plug


___________________________________________________________________________
Philadelphia Linux Users Group         --        http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion  --   http://lists.phillylinux.org/mailman/listinfo/plug