Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Re: CVE-2014-6271 – remote code execution through bash

seclists.org

Post reply on HN
Print view View original

21–30 of 52 posts

Re: Re: CVE-2014-6271 – remote code execution through bash

#21

Post by mrmondo »

psgbg wrote: post #14
mrmondo wrote: post #4

Debian patched this 8 hours ago, Redhat issued a patch about 3 hours ago, I believe Centos is still vulnerable, Ubuntu 14.10 isn't patched yet, Ubuntu 14.04 was patched about 3 hours ago.

I'm using debian jessie (testing) i386, and I had to download bash myself (from sid) because my up-to-date system was affected but the first patch was available for sid (unstable) and wheezy (stable) and not in jessie. So I don't know if every architecture, and version is updated with the same speed.

Jessie isn't released / stable and doesn't receive security patches until it is. It's called testing for a reason.

Re: Re: CVE-2014-6271 – remote code execution through bash

#22

Post by ScottBurson »

mrmondo wrote: post #4

Debian patched this 8 hours ago, Redhat issued a patch about 3 hours ago, I believe Centos is still vulnerable, Ubuntu 14.10 isn't patched yet, Ubuntu 14.04 was patched about 3 hours ago.

I did 'yum update bash' on my Centos 5.8 Linode a couple of hours ago, and it updated to 3.2-33 and is apparently no longer vulnerable, according to the one-line test I have been using:

  X="() { :;} ; echo busted" /bin/sh -c "echo stuff"

Re: Re: CVE-2014-6271 – remote code execution through bash

#24

Post by gklyne »

ScottBurson wrote: post #22
mrmondo wrote: post #4

Debian patched this 8 hours ago, Redhat issued a patch about 3 hours ago, I believe Centos is still vulnerable, Ubuntu 14.10 isn't patched yet, Ubuntu 14.04 was patched about 3 hours ago.

I did 'yum update bash' on my Centos 5.8 Linode a couple of hours ago, and it updated to 3.2-33 and is apparently no longer vulnerable, according to the one-line test I have been using: X="() { :;} ; echo busted" /bin/sh -c "echo stuff"

That test doesn't detect the vulnerability - needs to mention /bin/bash not /bin/sh

Re: Re: CVE-2014-6271 – remote code execution through bash

#27

Post by bigbugbag »

gklyne wrote: post #24
ScottBurson wrote: post #22

Earlier quoted context omitted.

I did 'yum update bash' on my Centos 5.8 Linode a couple of hours ago, and it updated to 3.2-33 and is apparently no longer vulnerable, according to the one-line test I have been using: X="() { :;} ; echo busted" /bin/sh -c "echo stuff"

That test doesn't detect the vulnerability - needs to mention /bin/bash not /bin/sh

Well, maybe you should look at your /bin/sh

ls -l /bin/sh

lrwxrwxrwx 1 root root 4 Sep 24 08:07 /bin/sh -> bash

Re: Re: CVE-2014-6271 – remote code execution through bash

#28

Post by bigbugbag »

mrmondo wrote: post #21
psgbg wrote: post #14

Earlier quoted context omitted.

I'm using debian jessie (testing) i386, and I had to download bash myself (from sid) because my up-to-date system was affected but the first patch was available for sid (unstable) and wheezy (stable) and not in jessie. So I don't know if every architecture, and version is updated with the same speed.

Jessie isn't released / stable and doesn't receive security patches until it is. It's called testing for a reason.

debian testing do receive security patches, but it is not a priority so they may not get there in a timely manner.

Re: Re: CVE-2014-6271 – remote code execution through bash

#29

Post by plq »

And I'd like to thank Gentoo developers for the usual very fast response they had towards this security advisory.

The moment I saw the news here, I ran to update my stuff -- the patch was already there, marked stable in the official gentoo repositories.

My impression is that they're following very closely the progression of this event and the relevant GLSA entries are being updated without any noticeable delays.

Thanks for running the show guys, you're true professionals!

Here's the relevant Gentoo Linux Security Advisory (GLSA) link: http://www.gentoo.org/security/en/glsa/glsa-201409-10.xml

Post reply on HN