Bash "shellshock" CVE-2014-6271 CVE-2014-7169

Diggy · 09-26-2014, 12:36 PM

All,

I have a legacy system running conary that I can't easily replace. Now that rPath is gone, the repositories are stale. I've tested the installed version of bash, and it's vulnerable. There is a patch available for the version that's running. My questions:

1) Can I patch an installed version, or must I patch the source, then install from source (hope it's the former!)?;

2) What is the specific command to apply the patch? I assume I have to aim the patch at something.

Any help would be greatly appreciated.

Thanks.

Diggy

coralfang · 09-26-2014, 12:51 PM

You have to apply the patch to source code.

For patching, you can usually just apply it like this:

Code:

# patch -Np1 < this-file-is-a-patch.patch

The steps typically follow this in most cases;

Code:

# tar -xvf bash-4.3.tar.gz
# mv this-file-is-a-patch.patch bash-4.3/ && cd bash-4.3/
# patch -Np1 < this-file-is-a-patch.patch
# make && make install

Diggy · 09-26-2014, 01:02 PM

Thank you, coralfang.

unSpawn · 09-26-2014, 01:06 PM

Quote:

Originally Posted by Diggy

I have a legacy system running conary that I can't easily replace. Now that rPath is gone, the repositories are stale.

I'm sorry to inform you that SAS took over rPath two years ago. If the fact this system wasn't migrated also implies it has been vulnerable for everything that occurred the past two years then you've got bigger problems on your hands than just patching. Just saying.

Quote:

Originally Posted by Diggy

Can I patch an installed version, or must I patch the source, then install from source (hope it's the former!)?;

If you can't create conary packages yourself then indeed it's the latter.

//Ah, I see this was answered already, bit late, but I'll keep it in.

Quote:

Originally Posted by Diggy

What is the specific command to apply the patch?

- Enter an unprivileged user account,
- Download the source of your Bash version, unpack it and cd into the directory,
- Download the most recent patch for your Bash version from https://ftp.gnu.org/pub/gnu/bash/bash-*-patches/,
- Verify its signature,
- Then run 'cat bash43-001 | patch -p0', followed by the usual './configure; make install',
- Test.