undefined | Better HN

0 pointsaroch11y ago0 comments

Debian7 doesn't look to be vulnerable by default (if the code snippet can be trusted to work):

    [arch/testbed ~] uname -a
    Linux 3.2.0-4-amd64 #1 SMP Debian 3.2.54-2 x86_64 GNU/Linux
    [arch/testbed ~]  env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
    bash: warning: x: ignoring function definition attempt
    bash: error importing function definition for `x'
    this is a test

0 comments

kazinator11y ago

I have a Debian Squeeze system. Just ran apt-get upgrade and bash wasn't upgraded at all. Just other things like CUPS, exim4, pgsql, ...

agwa11y ago

Squeeze doesn't have regular security support anymore. A subset of packages on i386 and amd64 are receiving long term security support, but you need to enable the Squeeze LTS repo:

https://wiki.debian.org/LTS/Using

ars11y ago

It has not reached the lts mirrors yet, but you can get it from http://incoming.debian.org/debian-buildd/pool/main/b/bash/

2 more replies

cbhl11y ago

Make sure security.debian.org is in your apt sources list?

kazinator11y ago

Thanks for the hint folks. My eyes glazed over when OSS people started using packages some 20 odd years ago.

My brain refuses to understand anything more than the beautiful simplicity of a tarball extracted from the / directory. :)

agwa11y ago

You appear to already have the updated package installed.

arochOP11y ago

Last dist-upgrade was about a week ago, all indications point towards the bash released back in Jan 2013. It's fixed in 4.2+dfsg-0.1+deb7u1 and I'm running 4.2+dfsg-0.1

agwa11y ago

Well, that's very odd because that command reports vulnerable on an unpatched Debian system, but fails with exactly that error message on a patched system.

j / k navigate · click thread line to collapse

0 pointsaroch11y ago0 comments

Debian7 doesn't look to be vulnerable by default (if the code snippet can be trusted to work):

    [arch/testbed ~] uname -a
    Linux 3.2.0-4-amd64 #1 SMP Debian 3.2.54-2 x86_64 GNU/Linux
    [arch/testbed ~]  env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
    bash: warning: x: ignoring function definition attempt
    bash: error importing function definition for `x'
    this is a test

0 comments

kazinator11y ago

I have a Debian Squeeze system. Just ran apt-get upgrade and bash wasn't upgraded at all. Just other things like CUPS, exim4, pgsql, ...

agwa11y ago

Squeeze doesn't have regular security support anymore. A subset of packages on i386 and amd64 are receiving long term security support, but you need to enable the Squeeze LTS repo:

https://wiki.debian.org/LTS/Using

ars11y ago

It has not reached the lts mirrors yet, but you can get it from http://incoming.debian.org/debian-buildd/pool/main/b/bash/

2 more replies

cbhl11y ago

Make sure security.debian.org is in your apt sources list?

kazinator11y ago

Thanks for the hint folks. My eyes glazed over when OSS people started using packages some 20 odd years ago.

My brain refuses to understand anything more than the beautiful simplicity of a tarball extracted from the / directory. :)

agwa11y ago

You appear to already have the updated package installed.

arochOP11y ago

Last dist-upgrade was about a week ago, all indications point towards the bash released back in Jan 2013. It's fixed in 4.2+dfsg-0.1+deb7u1 and I'm running 4.2+dfsg-0.1

agwa11y ago

Well, that's very odd because that command reports vulnerable on an unpatched Debian system, but fails with exactly that error message on a patched system.

j / k navigate · click thread line to collapse