CVE-2014-7169: Bash Fix Incomplete, Still Exploitable

Re:CVE-2014-7169: Bash Fix Incomplete, Still Exploitable by tribaal on Thursday September 25, 2014 @02:19AM (#8365878)

Since I'm an Ubuntu user, I use Landscape to keep my system up-to-date: https://landscape.canonical.com/

It did the patching for me during the night (I told it to do so for security updates), so I woke up to already patched systems.

Full disclaimer: I work for Canonical.

[ Parent | on HN ]

Re:CVE-2014-7169: Bash Fix Incomplete, Still Exploitable by reedloden on Thursday September 25, 2014 @03:30AM (#8366049)

I have no interest in paying for Ubuntu Advantage. I would happily pay a reasonable amount for just Landscape, but Canonical doesn't offer that. Get your sales guys to fix that, and you'll end up with a lot more Landscape users. Or better yet, just open source Landscape.

[ Parent | on HN ]

Re:CVE-2014-7169: Bash Fix Incomplete, Still Exploitable by noir_lord on Thursday September 25, 2014 @08:57AM (#8366843)

I would also be interested in a landscape only package at a reasonable price.

[ Parent | on HN ]

Re:CVE-2014-7169: Bash Fix Incomplete, Still Exploitable by Karunamon on Thursday September 25, 2014 @10:49AM (#8367455)

+1. Landscape has gotten zero serious evaluation at our company completely because of their heavy-handed pricing arrangement.

[ Parent | on HN ]

Re:CVE-2014-7169: Bash Fix Incomplete, Still Exploitable by riffraff on Thursday September 25, 2014 @03:52AM (#8366106)

I seem to have woken up to a patched system too, i.e.

    Start-Date: 2014-09-25  06:53:13
    Upgrade: libnss3-1d:amd64 (3.17-0ubuntu0.14.04.1, 3.17.1- 0ubuntu0.14.04.1), libnss3-nssdb:amd64 (3.17-0ubuntu0.14.04.1, 3.17.1-0ubuntu0.14.04.1), bash:amd64 (4.3-7ubuntu1, 4.3-7ubuntu1.1), libnss3:amd64 (3.17-0ubuntu0.14.04.1, 3.17.1-0ubuntu0.14.04.1)

I am an happy ubuntu user, but I think in this case "unattended-upgrade" might have been enough?

[ Parent | on HN ]

Re:CVE-2014-7169: Bash Fix Incomplete, Still Exploitable by zaroth on Thursday September 25, 2014 @03:18AM (#8366023)

How much does Landscape cost? I honestly can't figure it out.

The only thing I saw was ~$300 per server... most of my servers didn't cost anywhere near $300...

[ Parent | on HN ]

Re:CVE-2014-7169: Bash Fix Incomplete, Still Exploitable by reedloden on Thursday September 25, 2014 @03:31AM (#8366053)

You can't buy Landscape directly, sadly... You have to pay for Ubuntu Advantage, which is their support offering, which is why it's a ridiculous $$$ per server.

[ Parent | on HN ]

Re:CVE-2014-7169: Bash Fix Incomplete, Still Exploitable by merb on Thursday September 25, 2014 @03:13AM (#8366012)

When Landscape would be cheaper I would try to using it aswell, but since it's not I'm using ansible.

[ Parent | on HN ]