You are Here:
Linux Lite 6.0 Final Released - See Release Announcements



Bash Vulnerability and Linux Lite

Author (Read 4874 times)

0 Members and 1 Guest are viewing this topic.

Bash Vulnerability and Linux Lite
« on: September 25, 2014, 01:46:20 AM »
 

Dookus

  • Registered Linux User 533331
  • Forum Regular
  • ***
  • 101
    Posts
  • Reputation: 20
  • I'm just this guy .... y'know?!

  • Linux Lite: 3.0 64bit

  • CPU: Many

  • VIDEO CARD: Many
I just ran the commands on LL2
 
env X="() { :;} ; echo busted" /bin/sh -c "echo stuff"
env X="() { :;} ; echo busted" bash -c "echo stuff" 

and the second command came back with "busted"

Meaning LL is vulnerable

I imagine the patch for this is reliant on Ubuntu developers?


I'm just this guy ... Y'know!?
Registered Linux User 533331
 

Re: Bash Vulnerability and Linux Lite
« Reply #1 on: September 25, 2014, 05:20:57 AM »
 

Jerry

  • Linux Lite Creator
  • Administrator
  • Platinum Level Poster
  • *****
  • 8359
    Posts
  • Reputation: 779
  • Linux Lite Member
    • Linux Lite OS

  • Linux Lite: 5.6 64bit

  • CPU: Intel Core i9-10850K CPU @ 3.60GHz

  • MEMORY: 32Gb

  • VIDEO CARD: nVidia GeForce GTX 1650

  • Kernel: 5.x
Both of mine just came back as 'stuff'. I assume you have updated?

Code: [Select]
[email protected]:~$ env X="() { :;} ; echo busted" /bin/sh -c "echo stuff"
stuff
[email protected]:~$ env X="() { :;} ; echo busted" bash -c "echo stuff"
bash: warning: X: ignoring function definition attempt
bash: error importing function definition for `X'
stuff
[email protected]:~$
 

Re: Bash Vulnerability and Linux Lite
« Reply #2 on: September 25, 2014, 08:24:48 AM »
 

Scott

  • Global Moderator
  • Gold Level Poster
  • *****
  • 857
    Posts
  • Reputation: 186
  • Linux Lite Member

  • Linux Lite: 3.4 64bit

  • CPU: Dual core Intel Core i3 M 330

  • MEMORY: 6Gb

  • VIDEO CARD: Intel Integrated Graphics
My system was already fixed via the normal LL update method:
Menu > All > Install Updates

You can also check the bash package version, type:
Code: [Select]
dpkg -s bash | grep Version
The fixed versions are:
4.3-7ubuntu1.1,
4.2-2ubuntu2.2, and
4.1-2ubuntu3.1

My laptop, for example:
Code: [Select]
[email protected]:~$ dpkg -s bash | grep Version
Version: 4.3-7ubuntu1.1

So, I'm fixed!

If your system failed just update with:
Menu > All > Install Updates
And test the package version again.

The link below lists other tests as well.

Source:
http://askubuntu.com/questions/528101/what-is-the-cve-2014-6271-bash-vulnerability-and-how-do-i-fix-it
« Last Edit: September 25, 2014, 08:29:49 AM by Scott(0) »
 

Re: Bash Vulnerability and Linux Lite
« Reply #3 on: September 25, 2014, 03:20:09 PM »
 

Jerry

  • Linux Lite Creator
  • Administrator
  • Platinum Level Poster
  • *****
  • 8359
    Posts
  • Reputation: 779
  • Linux Lite Member
    • Linux Lite OS

  • Linux Lite: 5.6 64bit

  • CPU: Intel Core i9-10850K CPU @ 3.60GHz

  • MEMORY: 32Gb

  • VIDEO CARD: nVidia GeForce GTX 1650

  • Kernel: 5.x
IMPORTANT: If you have run Install Updates from the 25th onwards, then you are no longer vulnerable.

You bash version should now be > 4.3-7ubuntu1.3
To find out if you have the above version or higher, open a terminal and do (in 32 and 64 bit):

Code: [Select]
dpkg -s bash | grep Version
Run the 2 commands below from the terminal one at a time, each time it should return the word safe. If it returns the word vulnerable then do Menu, Install Updates and test again.

Code: [Select]
env X="() { :;} ; echo vulnerable" /bin/sh -c "echo safe"

env X="() { :;} ; echo vulnerable" bash -c "echo safe"

Alternatively you can do:

Code: [Select]
sudo apt-get update && sudo apt-get install bash
to get the latest version of bash.
« Last Edit: September 26, 2014, 10:37:41 AM by Valtam »
 

Re: Bash Vulnerability and Linux Lite
« Reply #4 on: September 25, 2014, 04:44:00 PM »
 

Scott

  • Global Moderator
  • Gold Level Poster
  • *****
  • 857
    Posts
  • Reputation: 186
  • Linux Lite Member

  • Linux Lite: 3.4 64bit

  • CPU: Dual core Intel Core i3 M 330

  • MEMORY: 6Gb

  • VIDEO CARD: Intel Integrated Graphics
Since I was asked a few times, thought I pass it along.

The vulnerability test (in reply #3 by Valtam) is the same for both 32 and 64 bit version of Linux Lite.
 

Re: Bash Vulnerability and Linux Lite
« Reply #5 on: September 25, 2014, 04:46:12 PM »
 

Jerry

  • Linux Lite Creator
  • Administrator
  • Platinum Level Poster
  • *****
  • 8359
    Posts
  • Reputation: 779
  • Linux Lite Member
    • Linux Lite OS

  • Linux Lite: 5.6 64bit

  • CPU: Intel Core i9-10850K CPU @ 3.60GHz

  • MEMORY: 32Gb

  • VIDEO CARD: nVidia GeForce GTX 1650

  • Kernel: 5.x
Thanks Scott, updated :) I have left the greater-than sign in there next to the version number so there is no need to change it in the future.
« Last Edit: September 26, 2014, 03:40:18 PM by Valtam »
 

Re: Bash Vulnerability and Linux Lite
« Reply #6 on: September 26, 2014, 08:01:35 AM »
 

newtusmaximus

  • Gold Level Poster
  • *******
  • 680
    Posts
  • Reputation: 67
  • Paypal Supporter.

  • Linux Lite: 3.8 64bit

  • CPU: Intel Core duo 6300 1.86GHz

  • MEMORY: 4Gb

  • VIDEO CARD: Intel 82Q963/Q965

  • Kernel: 5.x
Thanks for clarification and guidance. All OK here.  :)

However
Are we vulnerable through our  broadband routers?
« Last Edit: September 26, 2014, 08:04:08 AM by newtusmaximus »
2006 - HP DC7700p ultraslim Desktop Intel 6300 cpu  4GB Ram LL3.8 64bit.
2007 - Fujitsu Siemens V3405 Laptop  2 GB Ram LL3.6 32bit. Now 32bit Debian 9 + nonfree.
2006 - Fujitsu Siemens Si1520 Laptop Intel T720 cpu 3GB Ram   LL5.6 64 Bit
2003 - RETIRED Toshiba Satellite Pro A10 1 GB RAM LL2.8 32bit
 

Re: Bash Vulnerability and Linux Lite
« Reply #7 on: September 26, 2014, 09:39:06 AM »
 

Scott

  • Global Moderator
  • Gold Level Poster
  • *****
  • 857
    Posts
  • Reputation: 186
  • Linux Lite Member

  • Linux Lite: 3.4 64bit

  • CPU: Dual core Intel Core i3 M 330

  • MEMORY: 6Gb

  • VIDEO CARD: Intel Integrated Graphics
Valtam,

The bash package was updated again. The current version is:
Version: 4.3-7ubuntu1.3

Maybe this line should be updated in post #3 to prevent any confusion.
Quote
You bash version should now be > 4.3-7ubuntu1.1

 

Re: Bash Vulnerability and Linux Lite
« Reply #8 on: September 26, 2014, 10:38:10 AM »
 

Jerry

  • Linux Lite Creator
  • Administrator
  • Platinum Level Poster
  • *****
  • 8359
    Posts
  • Reputation: 779
  • Linux Lite Member
    • Linux Lite OS

  • Linux Lite: 5.6 64bit

  • CPU: Intel Core i9-10850K CPU @ 3.60GHz

  • MEMORY: 32Gb

  • VIDEO CARD: nVidia GeForce GTX 1650

  • Kernel: 5.x
Done.

Sent from my mobile phone.

 

Re: Bash Vulnerability and Linux Lite
« Reply #9 on: September 26, 2014, 03:01:29 PM »
 

Coastie

  • PayPal Supporter
  • Gold Level Poster
  • *****
  • 656
    Posts
  • Reputation: 52
  • Linux Lite User

  • Linux Lite: 3.8 64bit

  • CPU: AMD A10-6700 (ASUS M32)

  • MEMORY: 12Gb

  • VIDEO CARD: ADM Radeon HD (integrated)
For those like me who did not understand that shellshock is a bash vulnerability (or even what bash is) I am making this post so if they do a search for it they will find this thread.

I posted https://www.linuxliteos.com/forums/index.php?topic=941.msg5553#new because I did not know to search for bash.


Left Mac OS X for Linux in Jan 2014
 

Re: Bash Vulnerability and Linux Lite
« Reply #10 on: September 26, 2014, 03:22:15 PM »
 

rbdflyboy

  • Occasional Poster
  • **
  • 84
    Posts
  • Reputation: 10
  • Linux Lite Member
Thank you...got the info about this from PC World this morning. My Bash version passed and the first command was "safe". Failed the second command, did the update and am now safe. Thanks, again!
 

 

-->
X Close Ad

Linux Lite 6.0 Final Released - See Release Announcements