Bash security update published by Redhat

[accounts]

Got that test from another website, but will presume your answer is the right one.

[iseletsk]

What exactly do you think it tests? You are basically running:

bash -c "echo vulnerable to CVE-2014-7169"

of course it will print out: vulnerable to CVE-2014-7169
No injection here, bash just executes "echo ...." command.

[accounts]

I have that version installed. Heres another test that should work on any nix version:

env var=(){(a)=> bash -c "echo vulnerable to CVE-2014-7169"; /bin/true

[david]

Seems to be the correct version though?

https://rhn.redhat.com/errata/RHSA-2014-1306.html

[accounts]

For redhat based systems the test I mentioned above is here: https://access.redhat.com/articles/1200223

[david]

afaik it shouldnt print out those error messages kernow.

Check bottom https://access.redhat.com/articles/1212303 for the outputs when not affected.
Perhaps theres a difference of output from redhat and debian?

[accounts]

Until the fix comes, if you use mod_security add the rules posted here: https://access.redhat.com/articles/1212303

[tommy]

Update seem to be available now.

[sqh]

CloudLinux pushed out the first bash update, but now there is a second update available. My non-CloudLinux boxes got the update directly from the CentOS repo... just waiting for CloudLinux to catch up.

- Scott

[tommy]

Is the updated fix far away Igor?

[rodrigomf]

Yeah, figured it out, thank you very much!

[david]

bitlab:
try:

yum clean all

yum update bash

It also seems youre using yum priorities plugin. Perhaps youre holding bash back by having higher priority for some other repo?
Check priority in your /etc/yum.repos.d/ files and make sure cloudlinux.repo has the highest (lowest value) priority - that is: priority=1

[david]

Igor, will you guys be waiting for upstream for the next patch or will you guys patch it yourselves?

https://bugzilla.redhat.com/show_bug.cgi?id=1141597#c23

https://access.redhat.com/security/cve/CVE-2014-7169

Might not be as bad as I thought, so perhaps its worth waiting for upstream patch.

http://www.openwall.com/lists/oss-security/2014/09/24/40

[rodrigomf]

Hi there:

I just did exactly that but got this:

yum update bash
Loaded plugins: priorities, protectbase, rhnplugin, security
27 packages excluded due to repository priority protections
0 packages excluded due to repository protections
Setting up Update Process
No Packages marked for Update

Any clues?

[clm]

Thanks !

Is there a risk running ldconfig instead of rebooting ?