I just ran the commands on LL2
env X="() { :;} ; echo busted" /bin/sh -c "echo stuff"
env X="() { :;} ; echo busted" bash -c "echo stuff"
and the second command came back with "busted"
Meaning LL is vulnerable
I imagine the patch for this is reliant on Ubuntu developers?
Both of mine just came back as 'stuff'. I assume you have updated?
Code:
jerry@comp:~$ env X="() { :;} ; echo busted" /bin/sh -c "echo stuff"
stuff
jerry@comp:~$ env X="() { :;} ; echo busted" bash -c "echo stuff"
bash: warning: X: ignoring function definition attempt
bash: error importing function definition for `X'
stuff
jerry@comp:~$
My system was already fixed via the normal LL update method:
Menu > All > Install Updates
You can also check the bash package version, type:
Code:
dpkg -s bash | grep Version
4.3-7ubuntu1.1,
4.2-2ubuntu2.2, and
4.1-2ubuntu3.1
My laptop, for example:
Code:
scott@laptop:~$ dpkg -s bash | grep Version
Version: 4.3-7ubuntu1.1
So, I'm fixed!
If your system failed just update with:
Menu > All > Install Updates
And test the package version again.
The link below lists other tests as well.
Source:
http://askubuntu.com/questions/528101/wh...o-i-fix-it
IMPORTANT: If you have run Install Updates from the 25th onwards, then you are no longer vulnerable.
You bash version should now be >
4.3-7ubuntu1.3
To find out if you have the above version or higher, open a terminal and do (in 32 and 64 bit):
Code:
dpkg -s bash | grep Version
Run the 2 commands below from the terminal one at a time, each time it should return the word
safe. If it returns the word
vulnerable then do Menu, Install Updates and test again.
Code:
env X="() { :;} ; echo vulnerable" /bin/sh -c "echo safe"
env X="() { :;} ; echo vulnerable" bash -c "echo safe"
Alternatively you can do:
Code:
sudo apt-get update && sudo apt-get install bash
to get the latest version of
bash.
Since I was asked a few times, thought I pass it along.
The vulnerability test (in reply #3 by Valtam) is the same for both 32 and 64 bit version of Linux Lite.
Thanks Scott, updated :) I have left the greater-than sign in there next to the version number so there is no need to change it in the future.
Thanks for clarification and guidance. All OK here. :)
However
Are we vulnerable through our broadband routers?
Valtam,
The bash package was updated again. The current version is:
Version: 4.3-7ubuntu1.3
Maybe this line should be updated in post #3 to prevent any confusion.
Quote:You bash version should now be > 4.3-7ubuntu1.1
Done.
Sent from my mobile phone.
For those like me who did not understand that shellshock is a bash vulnerability (or even what bash is) I am making this post so if they do a search for it they will find this thread.
I posted
https://www.linuxliteos.com/forums/index...sg5553#new because I did not know to search for bash.