This is a static archive of the old Zorin Forum.

The information below may be outdated. Visit the new Zorin Forum here ›

If you have registered on the old forum, you will need to create an account on the new forum.

Shellshock test code?

ZDuncan

Tue Sep 30, 2014 10:11:14 pm

Sorry, dull question from someone dull about code.

I've updated to Zorin 9 with GNU bash, version 4.3.11(1)
The command "apt-cache policy bash" returns: Installed: 4.3-7ubuntu1.4
As far as I can tell these are the latest updates available.

I pasted the following line of code from a website (I found several sites with similar code), to ascertain whether my newly updated system is still vulnerable or not. In response, my computer churned out the following, some of which alarmed me as it implied someone else ('Oliver') was executing commands.

As you can tell, I know jack about code, so if any of you geniuses could cast your eye over the following and let me know whether I have anything to be concerned about, I'd appreciate it. Thank you.

mycomputername:~$ $ env 'x=() { :;}; echo this system is vulnerable' 'BASH_FUNC_x()=() { :;}; echo this system is vulnerable' bash -c "echo testing only"
$: command not found
mycomputername:~$
duncanleigh@duncanleigh-OptiPlex-GX520:~$ Oliver Krautscheid
Oliver: command not found
mycomputername:~$
mycomputername:~$ Oliver is the founder of webmaster.net and wants to help other webmasters to grow and monetize their sites. He started his first real site in 2006 and eventually turned his hobby into a six-figure business, specializing in SEO and Site Optimization.

Swarfendor437

Tue Sep 30, 2014 10:28:01 pm

Go to this site:

http://www.linuxnews.pro/patch-bash-she ... os-ubuntu/

and follow the instructions of 'Lanidarc' - scroll down to the first appearance - other posters reckon that his procedure ensures secure bash update. ;)

ZDuncan

Tue Sep 30, 2014 10:44:48 pm

Thanks. Did that and the test code - from the site you linked to, not the ones I took from previously - states the vulnerability has been patched ("this is a test")

Much appreciated.

Swarfendor437

Tue Sep 30, 2014 10:51:55 pm

Just for extra peace of mind take a look at the launchpad bug report page:

https://bugs.launchpad.net/ubuntu/+sour ... ug/1373781

click on the arrowhead next to 'trusty' and look at all the posts by Marc Deslauriers who mentions an 'echo' file being left in a directory that needs deleting if still there which can cause issues. ;)