6 ms·

Debian7 doesn't look to be vulnerable by default (if the code snippet can be trusted to work): [arch/testbed ~] uname -a Linux 3.2.0-4-amd64 #1 SMP Deb

by aroch 12y ago

Debian7 doesn't look to be vulnerable by default (if the code snippet can be trusted to work): [arch/testbed ~] uname -a Linux 3.2.0-4-amd64 #1 SMP Debian 3.2.54-2 x86_64 GNU/Linux [arch/testbed ~] env x='() { :;}; echo vulnerable' bash -c "echo this is a test" bash: warning: x: ignoring function definition attempt bash: error importing function definition for `x' this is a test

agwa 12y ago
You appear to already have the updated package installed.
- aroch 12y ago
  Last dist-upgrade was about a week ago, all indications point towards the bash released back in Jan 2013. It's fixed in 4.2+dfsg-0.1+deb7u1 and I'm running 4.2+dfsg-0.1
  - agwa 12y ago
    Well, that's very odd because that command reports vulnerable on an unpatched Debian system, but fails with exactly that error message on a patched system.
deleted 12y ago
[deleted]
- claudius 12y ago
  Yes, the printing of “vulnerable” in the 4th line of your code snippet.
kazinator 12y ago
I have a Debian Squeeze system. Just ran apt-get upgrade and bash wasn't upgraded at all. Just other things like CUPS, exim4, pgsql, ...
- cbhl 12y ago
  Make sure security.debian.org is in your apt sources list?
  - kazinator 12y ago
    Thanks for the hint folks. My eyes glazed over when OSS people started using packages some 20 odd years ago. My brain refuses to understand anything more than the beautiful simplicity of a tarball extracted from the / directory. :)
- agwa 12y ago
  Squeeze doesn't have regular security support anymore. A subset of packages on i386 and amd64 are receiving long term security support, but you need to enable the Squeeze LTS repo: https://wiki.debian.org/LTS/Using https://wiki.debian.org/LTS/Using
  - ars 12y ago
    It has not reached the lts mirrors yet, but you can get it from http://incoming.debian.org/debian-buildd/pool/main/b/bash/ http://incoming.debian.org/debian-buildd/pool/main/b/bash/
    - kazinator 12y ago
      Thanks. dpkg --install'ed the amd64 .deb package, and the vulnerability test passes now.
    - daveloyall 12y ago
      As of 7:24 PM GMT the above link has the amd64 .deb for sid. Still waiting on the i386 .deb for sid. Your link and this link (https://security-tracker.debian.org/tracker/CVE-2014-6271 https://security-tracker.debian.org/tracker/CVE-2014-6271) useful when considered together.
      - daveloyall 12y ago

by aroch 12y ago

agwa 12y ago

You appear to already have the updated package installed.

aroch 12y ago
Last dist-upgrade was about a week ago, all indications point towards the bash released back in Jan 2013. It's fixed in 4.2+dfsg-0.1+deb7u1 and I'm running 4.2+dfsg-0.1
- agwa 12y ago
  Well, that's very odd because that command reports vulnerable on an unpatched Debian system, but fails with exactly that error message on a patched system.

deleted 12y ago

[deleted]

claudius 12y ago
Yes, the printing of “vulnerable” in the 4th line of your code snippet.

kazinator 12y ago

I have a Debian Squeeze system. Just ran apt-get upgrade and bash wasn't upgraded at all. Just other things like CUPS, exim4, pgsql, ...

cbhl 12y ago
Make sure security.debian.org is in your apt sources list?
- kazinator 12y ago
  Thanks for the hint folks. My eyes glazed over when OSS people started using packages some 20 odd years ago. My brain refuses to understand anything more than the beautiful simplicity of a tarball extracted from the / directory. :)
agwa 12y ago
Squeeze doesn't have regular security support anymore. A subset of packages on i386 and amd64 are receiving long term security support, but you need to enable the Squeeze LTS repo: https://wiki.debian.org/LTS/Using https://wiki.debian.org/LTS/Using
- ars 12y ago
  It has not reached the lts mirrors yet, but you can get it from http://incoming.debian.org/debian-buildd/pool/main/b/bash/ http://incoming.debian.org/debian-buildd/pool/main/b/bash/
  - kazinator 12y ago
    Thanks. dpkg --install'ed the amd64 .deb package, and the vulnerability test passes now.
  - daveloyall 12y ago
    As of 7:24 PM GMT the above link has the amd64 .deb for sid. Still waiting on the i386 .deb for sid. Your link and this link (https://security-tracker.debian.org/tracker/CVE-2014-6271 https://security-tracker.debian.org/tracker/CVE-2014-6271) useful when considered together.
    - daveloyall 12y ago