3 ms·

Does anybody has steps what to do really as a sysadmin? Do I only need to install newest bash (on Linux systems) or do I also need to restart daemons like nginx

Does anybody has steps what to do really as a sysadmin? Do I only need to install newest bash (on Linux systems) or do I also need to restart daemons like nginx/apache etc. ?

sp332 12y ago
The vulnerability only affects bash when it is parsing environment variables, when it is just starting. So if a process is already running, it's not vulnerable and you don't have to restart it. You should definitely apply the patch from Wednesday, but be aware there is a related vulnerability that has no patch yet. Add the configuration from this page https://access.redhat.com/solutions/1207723 https://access.redhat.com/solutions/1207723 to your Apache or nginx config to deny malicious HTTP requests.
- windsurfer 12y ago
  This isn't always true. Frequently sub-shells are started without people really knowing, like with backticks or parenthesis.
  - sp332 12y ago
    But the sub-shell that gets started will use the new binary, which will be safe.