Linux Lite Forums

General => On Topic => Topic started by: newtusmaximus on September 25, 2014, 10:04:01 AM

Title: Bash vulnerability
Post by: newtusmaximus on September 25, 2014, 10:04:01 AM

http://www.bbc.co.uk/news/technology-29361794

What does this mean  for us?  reason for using linux was to be free from threats.

Title: Re: Deadly serious' new vulnerability found
Post by: Wirezfree on September 25, 2014, 10:51:16 AM

Quote from: newtusmaximus on September 25, 2014, 10:04:01 AM

http://www.bbc.co.uk/news/technology-29361794

What does this mean  for us?  reason for using linux was to be free from threats.

Look at this existing thread:
https://www.linuxliteos.com/forums/index.php?topic=925.msg5450;topicseen#msg5450 (https://www.linuxliteos.com/forums/index.php?topic=925.msg5450;topicseen#msg5450)

or just cut to the chase

Code: [Select]

env x='() { :;}; echo vulnerable' bash -c 'echo hello'
If vulnerable:

Code: [Select]

sudo apt-get update && sudo apt-get install bash
David

Title: Re: Deadly serious' new vulnerability found
Post by: ohjrson on September 25, 2014, 11:27:50 AM

Ok I did this and this is what I got.

ohjrson@ohjrson-MS-6728:~$ env x='() { :;}; echo vulnerable' bash -c 'echo hello'
bash: warning: x: ignoring function definition attempt
bash: error importing function definition for `x'
hello
ohjrson@ohjrson-MS-6728:~$

What does all that mean? and what do I do now?
Ok just ran this: dpkg -s bash | grep Version
and got this: Version: 4.3-7ubuntu1.1

So That means I am good. Now is that what is installed with all of LL 2.0? Cause I just installed Beryl onto that other laptop Is that ok?

Thanks.

Title: Re: Deadly serious' new vulnerability found
Post by: bitsnpcs on September 25, 2014, 11:38:53 AM

Hello,
this is addressed/fixed by installing an available update either by doing -
Menu>Favorites>Install Updates
or
Menu>All>Install Updates
Whichever is your preferred method for opening updates.

More info is found on this thread - https://www.linuxliteos.com/forums/index.php?topic=925.0 (https://www.linuxliteos.com/forums/index.php?topic=925.0)

Title: Re: Deadly serious' new vulnerability found
Post by: Wirezfree on September 25, 2014, 11:39:15 AM

Quote from: ohjrson on September 25, 2014, 11:27:50 AM

Ok I did this and this is what I got.

ohjrson@ohjrson-MS-6728:~$ env x='() { :;}; echo vulnerable' bash -c 'echo hello'
bash: warning: x: ignoring function definition attempt
bash: error importing function definition for `x'
hello
ohjrson@ohjrson-MS-6728:~$

What does all that mean? and what do I do now?
Ok just ran this: dpkg -s bash | grep Version
and got this: Version: 4.3-7ubuntu1.1

So That means I am good. Now is that what is installed with all of LL 2.0? Cause I just installed Beryl onto that other laptop Is that ok?

Thanks.

Hi

Well I followed those instructions...
It said I was Vulnerable...
I did the update... and then just got "Hello"
So from the instructions I assume it's O.K

David

Title: Re: Deadly serious' new vulnerability found
Post by: ohjrson on September 25, 2014, 12:02:18 PM

Check the version and see what it says.

Run this in terminal window: dpkg -s bash | grep Version
Paste results back in here.

Title: Re: Deadly serious' new vulnerability found
Post by: Jerry on September 25, 2014, 01:44:28 PM

Quote from: newtusmaximus on September 25, 2014, 10:04:01 AM

http://www.bbc.co.uk/news/technology-29361794

What does this mean  for us?  reason for using linux was to be free from threats.

There is no such thing as a vulnerable free operating system, it's technologically impossible. If I had a choice between windows that has vulnerabilities numbering in the millions vs linux that has a few, I know what side I'd rather be on.

Please continue this discussion over here - https://www.linuxliteos.com/forums/index.php?topic=925.0 this is the original thread. Thank you.