24

The test command

x='() { :;}; echo vulnerable' bash

shows that my Debian 8 (Jessie) installation is vulnerable, even with the latest updates. Research shows that there's a patch for stable and unstable, but that testing is unpatched.

I figure that the patch will make it to testing in a couple of days, but this actually looks nasty enough to be paranoid about. Is there any way to get the package from unstable and install it without breaking my system? Upgrading to unstable looks like it will cause more problems than it solves.


According to Bob, there is a second Shellshock vulnerability, which is fixed in a second patch. The test for it is supposed to be:

 env X='() { (a)=>\' bash -c "echo echo vuln"; [[ "$(cat echo)" == "vuln" ]] && echo "still vulnerable :("

But I'm not skilled enough in Bash to work out what this means or why it's a problem. At any rate, it does something weird, which is prevented by bash_4.3-9.2_amd64.deb on 64-bit systems, which at time of editing is in stable and unstable but not in Jessie/testing.

To fix this for Jessie, get the latest Bash from unstable and install it with dpkg -i.

Jemenake offers

wget http://ftp.debian.org/debian/pool/main/b/bash/bash_4.3-9.2_$(dpkg --print-architecture).deb

as a command which will get the 4.3-9.2 version for your machine.

And you can follow that with:

sudo dpkg -i bash_4.3-9.2_$(dpkg --print-architecture).deb

to install it.

Should you need further patches from unstable for your Jessie system, this is clearly the way to go (mutatis mutandis).

7 Answers 7

5

Download the package from unstable via this link. You can check the dependencies there as well, although it looks like the unstable bash has the same dependencies as the bash from testing. Install the downloaded deb with the following.

dpkg -i
5
  • 1
    Thanks, I did that and it fixed the problem without noticeably destroying anything. Presumably it will eventually get overwritten in the normal course of updates? Sep 25, 2014 at 15:16
  • 3
    The above link is fine if you're running a browser in a GUI. Less so if you're running lynx in a shell session. If you want something you can paste right into your command-line to grab it, try: wget http://ftp.debian.org/debian/pool/main/b/bash/bash_4.3-9.1_$(dpkg --print-architecture).deb It will get the right architecture for your box.
    – Jemenake
    Sep 25, 2014 at 17:33
  • 1
    @Jemenake You should post that as a separate answer.
    – Excellll
    Sep 25, 2014 at 17:37
  • This was definitely the answer I wanted, but now that the update's made it to Jessie, I think it's better if the accepted answer is the one people looking now need, so I'm moving the tick. Thanks though! Sep 26, 2014 at 18:54
  • Actually, there are two shellshock bugs, and the fix for the second one is now in sid but not jessie, so this is in fact still the right answer, (make sure you get 4.3-9.2!), although doubtless the situation will resolve soon. Sep 26, 2014 at 20:02
25

I've edited this answer for the additional bash fixes that were released on Monday.

For Ubuntu 12.04, I ran an update, but also had to run the install for bash to get rid of the vulnerability.

root@host:/home/ubuntu# env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
vulnerable
this is a test

That command shows the system is vulnerable, so run the update.

apt-get update && apt-get -y upgrade

Test again.

root@host:/home/ubuntu# env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
vulnerable
this is a test

Still vulnerable.

apt-get install -y bash

Test again.

root@host:/home/ubuntu# env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
bash: warning: x: ignoring function definition attempt
bash: error importing function definition for `x'
this is a test

Edit: After the additional patches were released, the output has changed.

root@host:/home/ubuntu# env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
this is a test

Yay! Fixed. This should work for other versions, but I haven't tested it beyond 12.04.

Also, runamok's reply below works well, so give him an upvote!

7
  • 6
    Just apt-get update && apt-get install -y bash seems to work.
    – runamok
    Sep 25, 2014 at 20:22
  • Based on the answer by @JabawokJayUK I'm still failing the first test after the bash update in Ubuntu 12.04.
    – Birla
    Sep 26, 2014 at 2:26
  • I am only getting this is a test but not the error and warning. In my local machine I do get the error, but in my server not. What does that meas? Is my server patched? Thank you. Sep 26, 2014 at 8:44
  • It seems the repository are up to date now, because I did not have to perform the apt-get install -y step, problem was solved alredy after upgrade.
    – Toluene
    Sep 26, 2014 at 10:08
  • 1
    This really doesn't answer the question about Debian testing/jessie. Ubuntu is a diffrent distribution with independent package repositories and patching schedules.
    – Bob
    Sep 26, 2014 at 10:59
16

An alternative for Debian 6.0 (Squeeze) without fetching packages from Debian 7 (Wheezy):

Use the LTS security repository that has the patch backported.

Add this to /etc/apt/sources.list:

#LTS security
deb http://http.debian.net/debian/ squeeze-lts main contrib non-free
deb-src http://http.debian.net/debian/ squeeze-lts main contrib non-free

Then run apt-get update && apt-get install bash.

Via: linuxquestions

1
  • Works for debian 6. We'd always keep LTC security in the list! Sep 28, 2014 at 3:12
4

apt-get update before apt-get dist-upgrade and you will get the patch. Just did it myself and there was a bash upgrade pushed which fixes the problem.

6
  • 2
    The problem was that Debian testing did not yet have the updated package, so downloading it manually from unstable and installing that was the most simple fix at that time; the solution given in this answer would not have worked. (Maybe by now it will, because the package may have migrated to testing.)
    – wurtel
    Sep 26, 2014 at 7:00
  • This doesn't answer the original question, but it's what people need to do now, so I'm accepting it so that it's the first thing people will see. The 'real' answer to my difficulty (it's in unstable and in stable but not in testing) is wurtel's answer using manual download of the new bash-????.deb and dpkg -i. Sep 26, 2014 at 18:57
  • I also think this is the answer for Ubuntu, now that they've pushed their fix properly, and probably for any other debian based distribution which is still maintained to the point where people have pushed fixes. Sep 26, 2014 at 19:06
  • Actually there are two shellshock bugs and the fix for the second one hasn't made it to jessie yet. Sep 26, 2014 at 20:00
  • This is still a valid solution and will remain so as long as the Debian testing security team is pushing updates; they may not have had it in testing at the time of OP question. One other option is setting all users to use Dash. This is mainly a server issue and not Sep 28, 2014 at 11:13
3

I fixed it on my Hackintosh by:

$ brew install bash

$ x='() { :;}; echo vulnerable' bash
bash: warning: x: ignoring function definition attempt
bash: error importing function definition for `x'
bash-4.3$ 
1
  • 2
    do not forget to install the brew before... Sep 26, 2014 at 14:14
1

I've written an article on how to do this with apt-get on old Ubuntu versions. You basically update your sources.list to the newest and then run apt-get update and upgrade bash. You can read it step for step or copypaste it from here.

Summary:

sudo sed -i 's/YOUR_OS_CODENAME/trusty/g' /etc/apt/sources.list
sudo apt-get update
sudo apt-get install --only-upgrade bash

Read the article if you use old-releases.ubuntu.com and don't forget that you might want to change it back:

sudo sed -i 's/trusty/YOUR_OS_CODENAME/g' /etc/apt/sources.list
1
  • uh… this will leave your system with Trusty in sources.list. next time you update, the system will upgrade to Trusty. this will SEVERELY break your system.
    – strugee
    Sep 27, 2014 at 2:43
1

The fixed version (see changelog) for the Bash package is in Debian 8 (Jessie) now (see package info), as of 2014-09-26 14:18 UTC.

The second fix, mentioned in the comments below, is also in the Jessie repository now. There is no need to install from unstable. See the package information link above.

There is no need to install from unstable any more.

Just run:

# aptitude update

followed by:

# aptitude upgrade

Then verify that the vulnerability is gone (in a newly opened shell):

$ x='() { :;}; echo vulnerable' bash
bash: warning: x: ignoring function definition attempt
bash: error importing function definition for `x'
5
  • Doesn't fix the followup CVE-2014-7169 yet.
    – Bob
    Sep 26, 2014 at 14:46
  • @Bob, I think that's only relevant to Ubuntu? And presumably Ubuntu have already fixed it. Sep 26, 2014 at 18:55
  • @JohnLawrenceAspden Nope. Try running env X='() { (a)=>\' bash -c "echo echo vuln"; [[ "$(cat echo)" == "vuln" ]] && echo "still vulnerable :(" - if it prints still vulnerable, then the latter vuln isn't patched yet. AFAIK, jessie is still vulnerable. Note that that command will create a file named echo in the current directory if successful, and you'll need to delete it before re-running the test.
    – Bob
    Sep 26, 2014 at 19:22
  • @Bob, I can't make head or tail of this, what is the bit up to the semicolon doing? Sep 26, 2014 at 19:51
  • @Bob, but whatever it does, you're right that upgrading to the 4.3-9.2 version in unstable stops it! Sep 26, 2014 at 19:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .