CVE-2014-6271: Remote code execution through bash

Re:CVE-2014-6271: Remote code execution through bash by teach on Wednesday September 24, 2014 @01:17PM (#8362706)

Just did an update on my Linode and one of the updates was

    replace bash 4.1-2ubuntu3

So seems like it's there now.

[ Parent | on HN ]

Re:CVE-2014-6271: Remote code execution through bash by steveklabnik on Wednesday September 24, 2014 @01:52PM (#8362946)

https://launchpad.net/ubuntu/+source/bash/4.3-7ubuntu1.1 seems to be at least one version of the fix, I'm unsure about LTS and other releases.

[ Parent | on HN ]

Re:CVE-2014-6271: Remote code execution through bash by sp332 on Wednesday September 24, 2014 @03:35PM (#8363622)

http://www.ubuntu.com/usn/usn-2362-1/

Ubuntu 14.04 LTS: bash 4.3-7ubuntu1.1

Ubuntu 12.04 LTS: bash 4.2-2ubuntu2.2

Ubuntu 10.04 LTS: bash 4.1-2ubuntu3.1

For releases in-between, you should be able to manually download one of those versions from http://archive.ubuntu.com/ubuntu/pool/main/b/bash/ and install it. I wonder how many vulnerable boxes there are that won't get these updates because Ubuntu stops support after 9 months. There must be tons of boxes running 13.10, it's not even a year old yet.

[ Parent | on HN ]

Re:CVE-2014-6271: Remote code execution through bash by merlinmike on Friday September 26, 2014 @12:32AM (#8371342)

For 13.10 do this, selecting correct architecture:

----------------------------------------------------------

amd64

wget archive.ubuntu.com/ubuntu/pool/main/b/bash/bash_4.2-2ubuntu2.3_amd64.deb

sudo dpkg -i bash_4.2-2ubuntu2.3_amd64.deb

----------------------------------------------------------

i386

wget archive.ubuntu.com/ubuntu/pool/main/b/bash/bash_4.2-2ubuntu2.3_i386.deb

sudo dpkg -i bash_4.2-2ubuntu2.3_i386.deb

[ Parent | on HN ]

Re:CVE-2014-6271: Remote code execution through bash by bphogan on Wednesday September 24, 2014 @06:33PM (#8364545)

It's for that reason that I just ignore anything that's not an LTS release. It's never worth the hassle for me.

[ Parent | on HN ]

Re:CVE-2014-6271: Remote code execution through bash by traviscj on Wednesday September 24, 2014 @01:45PM (#8362897)

Depends on whether you have mirrors.linode.com or the ubuntu servers set up in sources.list. I had to swap mine out.

[ Parent | on HN ]

Re:CVE-2014-6271: Remote code execution through bash by teach on Wednesday September 24, 2014 @02:09PM (#8363075)

Well, I didn't even know about mirrors.linode.com. Mine were still the ubuntu default servers.

I guess apt-get from one of Linode's mirrors saves bandwidth? Or is it just more polite?

[ Parent | on HN ]

Re:CVE-2014-6271: Remote code execution through bash by aaronem on Wednesday September 24, 2014 @03:14PM (#8363504)

It probably ensures that you get the Linode-customized flavors of packages where such exist, so that, for example, you don't inadvertently upgrade your kernel to a build without the ability to mount Linode disks.

[ Parent | on HN ]

Re:CVE-2014-6271: Remote code execution through bash by crylon on Wednesday September 24, 2014 @05:33PM (#8364270)

Linode can't modify packages; they're signed by the upstream distro. (Unless Linode added a key of their own to your apt keychain (apt-key list), but I've never seen that.)

[ Parent | on HN ]

Re:CVE-2014-6271: Remote code execution through bash by iancarroll on Wednesday September 24, 2014 @03:47PM (#8363684)

It's also meant to help you and Linlde save bandwidth!

[ Parent | on HN ]