Re: Remotely exploitable bug in systemd (CVE-2017-9445)

2017-07-03 Thread Larry Dighera
On Sat, 1 Jul 2017 16:36:41 -0400, you wrote: >Howdy! CVE-2017-9445 is a remotely exploitable bug in systemd. It was >first announced to the public about four or five days ago, not sure >when it would have been announced to the security team. > >Am I correct in interpreting this:

Re: Remotely exploitable bug in systemd (CVE-2017-9445)

2017-07-02 Thread davidson
On Sun, 2 Jul 2017, Jimmy Johnson wrote: How was this problem created in the first place? http://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-9445.html % % Notes % chrisccoulson> I believe this was introduced in v223 by %

Re: Remotely exploitable bug in systemd (CVE-2017-9445)

2017-07-02 Thread tomas
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Sun, Jul 02, 2017 at 03:35:45PM +0300, Reco wrote: > Hi. > > On Sun, 2 Jul 2017 10:24:13 +0100 > Michael Fothergill wrote: > > > On 2 July 2017 at 09:26, Sven Joachim wrote: > > > > > On

Re: Remotely exploitable bug in systemd (CVE-2017-9445)

2017-07-02 Thread Reco
Hi. On Sun, 2 Jul 2017 10:24:13 +0100 Michael Fothergill wrote: > On 2 July 2017 at 09:26, Sven Joachim wrote: > > > On 2017-07-02 09:34 +0200, Pascal Hambourg wrote: > > > > > Le 01/07/2017 à 23:19, Sven Joachim a écrit : > > >> On

Clarifying what 'systemd' actually means (was: Re: Remotely exploitable bug in systemd (CVE-2017-9445))

2017-07-02 Thread Christian Seiler
On 07/02/2017 11:24 AM, Michael Fothergill wrote: > ​Could this be exploited to force people to use sysvinit instead of systemd ? This bug has nothing to do with systemd as the init system, it's in an optional component that's disabled by default on Debian. In principle, I suspect that resolved

Re: Remotely exploitable bug in systemd (CVE-2017-9445)

2017-07-02 Thread Michael Fothergill
On 2 July 2017 at 09:26, Sven Joachim wrote: > On 2017-07-02 09:34 +0200, Pascal Hambourg wrote: > > > Le 01/07/2017 à 23:19, Sven Joachim a écrit : > >> On 2017-07-01 16:36 -0400, Perry E. Metzger wrote: > >> > >>> Am I correct in interpreting this: > >>>

Re: Remotely exploitable bug in systemd (CVE-2017-9445)

2017-07-02 Thread Jimmy Johnson
On 07/02/2017 01:26 AM, Sven Joachim wrote: On 2017-07-02 09:34 +0200, Pascal Hambourg wrote: Le 01/07/2017 � 23:19, Sven Joachim a �crit : On 2017-07-01 16:36 -0400, Perry E. Metzger wrote: Am I correct in interpreting this: https://security-tracker.debian.org/tracker/CVE-2017-9445 as

Re: Remotely exploitable bug in systemd (CVE-2017-9445)

2017-07-02 Thread Sven Joachim
On 2017-07-02 09:34 +0200, Pascal Hambourg wrote: > Le 01/07/2017 à 23:19, Sven Joachim a écrit : >> On 2017-07-01 16:36 -0400, Perry E. Metzger wrote: >> >>> Am I correct in interpreting this: >>> https://security-tracker.debian.org/tracker/CVE-2017-9445 >>> as meaning a fix to it still isn't in

Re: Remotely exploitable bug in systemd (CVE-2017-9445)

2017-07-02 Thread Pascal Hambourg
Le 01/07/2017 à 23:19, Sven Joachim a écrit : On 2017-07-01 16:36 -0400, Perry E. Metzger wrote: Am I correct in interpreting this: https://security-tracker.debian.org/tracker/CVE-2017-9445 as meaning a fix to it still isn't in sid, and therefore is not yet in the process of percolating down

Re: Remotely exploitable bug in systemd (CVE-2017-9445)

2017-07-01 Thread Mark Fletcher
On Sun, Jul 02, 2017 at 12:44:20AM +0200, deloptes wrote: > > I don't think it is that new as I have not done any upgrades recently and I > have > dpkg -l | grep systemd > ii libpam-systemd:amd64 215-17+deb8u7 > > amd64system and service

Re: Remotely exploitable bug in systemd (CVE-2017-9445)

2017-07-01 Thread deloptes
Perry E. Metzger wrote: > Howdy! CVE-2017-9445 is a remotely exploitable bug in systemd. It was > first announced to the public about four or five days ago, not sure > when it would have been announced to the security team. > > Am I correct in interpreting this: >

Re: Remotely exploitable bug in systemd (CVE-2017-9445)

2017-07-01 Thread Sven Joachim
On 2017-07-01 16:36 -0400, Perry E. Metzger wrote: > Howdy! CVE-2017-9445 is a remotely exploitable bug in systemd. It was > first announced to the public about four or five days ago, not sure > when it would have been announced to the security team. > > Am I correct in interpreting this: >

Remotely exploitable bug in systemd (CVE-2017-9445)

2017-07-01 Thread Perry E. Metzger
Howdy! CVE-2017-9445 is a remotely exploitable bug in systemd. It was first announced to the public about four or five days ago, not sure when it would have been announced to the security team. Am I correct in interpreting this: https://security-tracker.debian.org/tracker/CVE-2017-9445 as meaning