4 ms·

Is there anything beyond getting what our distro sends down the pipeline? Exactly how behind would I be if I did that?

gpvos 12y ago
Your distro should be up to date already. They have been pretty quick on the uptake, many even quicker than the bash maintainer himself. Your bash is safe if it has a patch level equivalent to bash 4.3-027 (released 27-Sep-2014 22:38). Several distros had the equivalent patch by Florian Weimer already a day earlier. The later bash patches fixed the underlying bugs, but that patch removed the attack surface (but introduced a backwards compatibility problem for the very, very few programs (I don't know of any) that actually create shell functions to be inherited by bash).
- reirob 12y ago
  Just checked on my Raspberry Pi, Raspbian does not yet provide a fix.
  - orblivion 12y ago
    I didn't get any updates on Debian yet either. From reading this: http://unix.stackexchange.com/questions/158767/which-debian-patches-fixes-shellshock-lcamtuf-cve-2014-6277-and-cve-2014-6278 http://unix.stackexchange.com/questions/158767/which-debian-... It looks like Debian may have applied something to make the attack not exploitable, even though it still segfaults. Seems weird to me, but it's the best explanation I have.
    - gpvos 12y ago
      You are confused. You say that you didn't get any updates on Debian, yet you say that it looks like Debian may have applied something. As I explained above, the patch for CVE-7169 by Florian Weimer made bash invulnerable to code injection by arbitrary environment variables. The underlying bugs CVE-6277 and CVE-6278 therefore have no known attack vector from outside bash, though they can still be triggered from a shell script or the command line if they are not patched. Theoretically, they could become part of a different attack, so it's wise to patch them, but there's no hurry, since as long as you or Debian have applied the abovementioned patch for CVE-7169, it means there's currently no publicly-known exploit. Also, Debian uses dash as its version of sh, so the problem can only occur if bash is called explicitly.

gpvos 12y ago

Your distro should be up to date already. They have been pretty quick on the uptake, many even quicker than the bash maintainer himself. Your bash is safe if it has a patch level equivalent to bash 4.3-027 (released 27-Sep-2014 22:38). Several distros had the equivalent patch by Florian Weimer already a day earlier. The later bash patches fixed the underlying bugs, but that patch removed the attack surface (but introduced a backwards compatibility problem for the very, very few programs (I don't know of any) that actually create shell functions to be inherited by bash).

reirob 12y ago
Just checked on my Raspberry Pi, Raspbian does not yet provide a fix.
- orblivion 12y ago
  I didn't get any updates on Debian yet either. From reading this: http://unix.stackexchange.com/questions/158767/which-debian-patches-fixes-shellshock-lcamtuf-cve-2014-6277-and-cve-2014-6278 http://unix.stackexchange.com/questions/158767/which-debian-... It looks like Debian may have applied something to make the attack not exploitable, even though it still segfaults. Seems weird to me, but it's the best explanation I have.
  - gpvos 12y ago
    You are confused. You say that you didn't get any updates on Debian, yet you say that it looks like Debian may have applied something. As I explained above, the patch for CVE-7169 by Florian Weimer made bash invulnerable to code injection by arbitrary environment variables. The underlying bugs CVE-6277 and CVE-6278 therefore have no known attack vector from outside bash, though they can still be triggered from a shell script or the command line if they are not patched. Theoretically, they could become part of a different attack, so it's wise to patch them, but there's no hurry, since as long as you or Debian have applied the abovementioned patch for CVE-7169, it means there's currently no publicly-known exploit. Also, Debian uses dash as its version of sh, so the problem can only occur if bash is called explicitly.