Re: [Full-disclosure] bash vulnerability?

[starwars <nobody@xxxxxxxxxxxxxxxxxxxxxx>]

>
>
> Wernfried Haas wrote:
>
> > assuming you actually meant
> > :(){ :|:& };: (which can be harmful if no limits are set)?

   It should be noted that according to the limits man page, "By default no 
quotas are imposed on 'root'. In fact, there is no way to impose limits via 
this procedure to root-equiv accounts (account with UID 0)."

"ulimit -u 15"
 
  only works temporarily for that user unless issed in a startup script. "echo 
'* U15' > /etc/limits" 

(as root of course) is a permanent solution (root is still unaffected).

-secjunky 
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/