News for hackers. Stuff that matters.

A comment on CVE-2014-6271: Remote code execution through bash. Parent comment

Re:CVE-2014-6271: Remote code execution through bash by sp332 on Wednesday September 24, 2014 @03:35PM (#8363622)
http://www.ubuntu.com/usn/usn-2362-1/

Ubuntu 14.04 LTS: bash 4.3-7ubuntu1.1

Ubuntu 12.04 LTS: bash 4.2-2ubuntu2.2

Ubuntu 10.04 LTS: bash 4.1-2ubuntu3.1

For releases in-between, you should be able to manually download one of those versions from http://archive.ubuntu.com/ubuntu/pool/main/b/bash/ and install it. I wonder how many vulnerable boxes there are that won't get these updates because Ubuntu stops support after 9 months. There must be tons of boxes running 13.10, it's not even a year old yet.

[ Parent | on HN ]
Re:CVE-2014-6271: Remote code execution through bash by merlinmike on Friday September 26, 2014 @12:32AM (#8371342)
For 13.10 do this, selecting correct architecture:

----------------------------------------------------------

amd64

wget archive.ubuntu.com/ubuntu/pool/main/b/bash/bash_4.2-2ubuntu2.3_amd64.deb

sudo dpkg -i bash_4.2-2ubuntu2.3_amd64.deb

----------------------------------------------------------

i386

wget archive.ubuntu.com/ubuntu/pool/main/b/bash/bash_4.2-2ubuntu2.3_i386.deb

sudo dpkg -i bash_4.2-2ubuntu2.3_i386.deb

[ Parent | on HN ]
Re:CVE-2014-6271: Remote code execution through bash by bphogan on Wednesday September 24, 2014 @06:33PM (#8364545)
It's for that reason that I just ignore anything that's not an LTS release. It's never worth the hassle for me.
[ Parent | on HN ]