Bash vulnerability

[Michael_McKenney]

95% of home routers are not secure from 10 different issues that will not get fixed. I recommend shutting down completely when you are not using your computers.

[fprietog]

I have both 12.04 and 14.04 and quite a few friends/family machines I look after. Are we/you saying this is not solved at this point?

It's CVE 2014-6271 and its partially solved. There is another report CVE 2014-7169 that was caused by the prior fix and its unsolved (for now).

You got the info for testing and the links to both reports in the prior post to yours.

[montag dp]

I am in charge of an archive server that doesn't have bash, but it does have sh as the default shell. It runs some proprietary Linux version (actually, I think it might be Ubuntu-based from what I can tell), but it doesn't have apt-get or even any compilers on it. Running the test with "bash" replaced by "sh" reports that it is vulnerable. Does anyone know if there's a patch for sh? Even if there is, I don't know how I would install it since I can't compile anything on it ... I will probably have to get in touch with the vendor.

[translux]

Sorry if this is a noob question.

upgraded today to 12.04 LTS

env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
vulnerable

I followed the 1st post and believe I was successful. Thank you oldrocker99 for this.
When I run the 1st test I think what is returned is correct

env x='() { :;}; echo vulnerable' /bin/bash.old -c echo
vulnerable

When I run the 2nd test I'm thinking this not correct?

env x='() { :;}; echo vulnerable' bash -c echo
env: bash: No such file or directory

Any guidance would be greatly appreciated.

Thank You
TL

[donsy]

Useful info:
http://www.symantec.com/connect/blog...-vulnerability

[tgalati4]

So, in effect, any embedded platform that has busybox would be affected as well?

[translux]

So, in effect, any embedded platform that has busybox would be affected as well?

Negative Busybox is OK
From the article linked above.

Iternet of Things (IoT) and embedded devices such as routers may be vulnerable if they’re running BASH. However, many newer devices run a set of tools called BusyBox which offers an alternative to BASH. Devices running BusyBox are not vulnerable to the Bash Bug.

[rob-rushworth]

Ubuntu 12.04.5... cleanly re-installed a month ago and updated recently.

Go to Update Manager and get the new bash.

Easy.

[mastablasta]

we are just talking that it is not so easy since it doesn't solve the problem. it is only partial solution, but at least there is. anyway i am hoping we will have this patched by sunday

[cogset]

95% of home routers are not secure from 10 different issues that will not get fixed. I recommend shutting down completely when you are not using your computers.

Would you explain this? I know routers are a weak point,what do I gain by shutting a router down when not in use? Minimize exposure?