News for hackers. Stuff that matters.

A comment on CVE-2014-6271: Remote code execution through bash. Parent comment

Re:CVE-2014-6271: Remote code execution through bash by vhost- on Wednesday September 24, 2014 @03:51PM (#8363704)
If you just want to upgrade bash, and prevent services like nginx, fpm, and apache from being restarted in production, you can run `sudo apt-get update && sudo apt-get install --only-upgrade bash`

Related to that, does anyone else know if upgrading bash will require a restart of other services kind of like upgrading openssl requires restarting things?

[ Parent | on HN ]
Re:CVE-2014-6271: Remote code execution through bash by jMyles on Wednesday September 24, 2014 @08:56PM (#8364982)
It runs out that these suggestions were premature, the patch released earlier today DOES NOT fix the problem. https://bugzilla.redhat.com/show_bug.cgi?id=1141597#c24

I just tested this on Ubuntu 14.04 - it's vulnerable.

[ Parent | on HN ]
Re:CVE-2014-6271: Remote code execution through bash by euid on Wednesday September 24, 2014 @06:35PM (#8364550)
Upgrades should not require any restarts, and no restarts are required for you to stop being vulnerable - as this only affects newly created bash sessions, not already running ones.
[ Parent | on HN ]
Re:CVE-2014-6271: Remote code execution through bash by stefantalpalaru on Wednesday September 24, 2014 @08:36PM (#8364933)
Debian's package manager has the nasty habit of stopping affected daemons before all the upgrades and starting them afterwards, leaving you with serious downtime.
[ Parent | on HN ]
Re:CVE-2014-6271: Remote code execution through bash by auxiliation on Wednesday September 24, 2014 @04:25PM (#8363920)
> Related to that, does anyone else know if upgrading bash will require a restart of other services kind of like upgrading openssl requires restarting things?

I don't think it will, for a couple of reasons. OpenSSL is integrated into other services as a library, while bash would be called as an external application. I also noticed that once I upgraded bash, the proof of concept stopped working in a terminal I opened prior to the upgrade.

[ Parent | on HN ]
Re:CVE-2014-6271: Remote code execution through bash by fragmede on Wednesday September 24, 2014 @07:28PM (#8364727)
> I also noticed that once I upgraded bash, the proof of concept stopped working in a terminal I opened prior to the upgrade.

[citation needed] because that doesn't sound possible.

[ Parent | on HN ]
Re:CVE-2014-6271: Remote code execution through bash by lutusp on Wednesday September 24, 2014 @07:32PM (#8364736)
Not if the issued commands spawned a new copy of Bash.
[ Parent | on HN ]