CVE-2014-6271: Remote code execution through bash

Re:CVE-2014-6271: Remote code execution through bash by steveklabnik on Wednesday September 24, 2014 @01:52PM (#8362946)

https://launchpad.net/ubuntu/+source/bash/4.3-7ubuntu1.1 seems to be at least one version of the fix, I'm unsure about LTS and other releases.

[ Parent | on HN ]

Re:CVE-2014-6271: Remote code execution through bash by sp332 on Wednesday September 24, 2014 @03:35PM (#8363622)

http://www.ubuntu.com/usn/usn-2362-1/

Ubuntu 14.04 LTS: bash 4.3-7ubuntu1.1

Ubuntu 12.04 LTS: bash 4.2-2ubuntu2.2

Ubuntu 10.04 LTS: bash 4.1-2ubuntu3.1

For releases in-between, you should be able to manually download one of those versions from http://archive.ubuntu.com/ubuntu/pool/main/b/bash/ and install it. I wonder how many vulnerable boxes there are that won't get these updates because Ubuntu stops support after 9 months. There must be tons of boxes running 13.10, it's not even a year old yet.

[ Parent | on HN ]

Re:CVE-2014-6271: Remote code execution through bash by merlinmike on Friday September 26, 2014 @12:32AM (#8371342)

For 13.10 do this, selecting correct architecture:

----------------------------------------------------------

amd64

wget archive.ubuntu.com/ubuntu/pool/main/b/bash/bash_4.2-2ubuntu2.3_amd64.deb

sudo dpkg -i bash_4.2-2ubuntu2.3_amd64.deb

----------------------------------------------------------

i386

wget archive.ubuntu.com/ubuntu/pool/main/b/bash/bash_4.2-2ubuntu2.3_i386.deb

sudo dpkg -i bash_4.2-2ubuntu2.3_i386.deb

[ Parent | on HN ]

Re:CVE-2014-6271: Remote code execution through bash by bphogan on Wednesday September 24, 2014 @06:33PM (#8364545)

It's for that reason that I just ignore anything that's not an LTS release. It's never worth the hassle for me.

[ Parent | on HN ]