IMPORTANT: Shellshock -- *nix bash vulnerability

[palmtree5]

Bug in Bash shell creates big security hole on anything with *nix in it [Updated] | Ars Technica

 

[lunatic59]

Already updated bash on my servers. I wonder if Apple or the Mac community are really that effected?

 

[palmtree5]

Already updated bash on my servers. I wonder if Apple or the Mac community are really that effected?

Think Bash is the default on Macs

 

[lunatic59]

Think Bash is the default on Macs

or does Apple include their own iteration ... iBash? I would assume for the vulnerability to work, they'd need an open port (http:80?) and http services enabled. :dontknow:

 

[MoodyBlues]

Bug in Bash shell creates big security hole on anything with *nix in it [Updated] | Ars Technica

Thanks for posting this. I was unaware of it.

I hadn't applied today's system updates yet...

$ env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
vulnerable
this is a test

...but now I have:

$ env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
bash: warning: x: ignoring function definition attempt
bash: error importing function definition for `x'
this is a test

 

[palmtree5]

Seems like they might be using a rather outdated version of bash...

version.h (Bash 3.2.51)

Current is 4.3.24

 

[Dngrsone]

I patched last night... sometimes Canonical does do things right.


*** Edit: Hrm, just updated again.

 

[iowabowtech]

I haven't had much time to research this yet but I'm assuming it may already be patched in the major distros?

Bash shell 'Shellshock' flaw opens OS X, Linux, more to attack, called 'bigger than Heartbleed'

Patch Bash NOW: 'Shell Shock' bug blasts OS X, Linux systems wide open • The Register Forums

 

[MoodyBlues]

I haven't had much time to research this yet but I'm assuming it may already be patched in the major distros?

Bash shell 'Shellshock' flaw opens OS X, Linux, more to attack, called 'bigger than Heartbleed'

Patch Bash NOW: 'Shell Shock' bug blasts OS X, Linux systems wide open The Register Forums

Threads split and merged; this deserved its own thread. Thanks to iowabowtech for the excellent suggestion.

 

[MoodyBlues]

I patched last night... sometimes Canonical does do things right.


*** Edit: Hrm, just updated again.

Do you have yours set to update automatically? I don't. I like to see, and perhaps pick and choose, what's on tap to be updated.

 

[iowabowtech]

Thanks for posting this. I was unaware of it.

I hadn't applied today's system updates yet...





...but now I have:

Same results here in the same order. Oh wait, you run the premier distro too, should have known we'd have similar findings.

...ducks for cover...

:vroam:







I kid, I kid. No distro wars please.

 

[MoodyBlues]

Same results here in the same order. Oh wait, you run the premier distro too, should have known we'd have similar findings.

...ducks for cover...

:vroam:




I kid, I kid. No distro wars please.

OH NO!!

:rofl:

 

[Dngrsone]

Do you have yours set to update automatically? I don't. I like to see, and perhaps pick and choose, what's on tap to be updated.

No, I get alerts, and pick and choose which updates I want to install. Otherwise, I'd be forever uninstalling bad updates.

 

[MoodyBlues]

Pay attention to your ongoing system update notifications, *buntu folks. I've now had bash updates three days in a row.