Re: [Ltib] patch for Bash bug

[Peter Barada]

On 09/30/2014 05:18 PM, Peter Barada wrote:

On 09/30/2014 04:06 PM, Todd Sampson wrote:

Is there a patch available for Bash? I notice most of the tools in my /bin are linked to Busybox except for Bash.

_______________________________________________
LTIB home page: http://ltib.org

Ltib mailing list
address@hidden
https://lists.nongnu.org/mailman/listinfo/ltib

I've got one I'll send out tomorrow as a tarball (since it kicks bash up to the latest version with patches 001-025).

Since I can't send the bash tarball through email due to size, grab the bash-4.3 tarball from http://ftp.gnu.org/gnu/bash/bash-4.3.tar.gz and place it (and the attached patch and md5 files) in your LPP (local package pool in /opt/ltib/pkgs), and also replace dist/lfs-5.1/bash/bash.spec with the attached bash.spec.

Execute "./ltib -p bash" and you'll end up with bash updated to version 4.3.25(1) which passes the Shellshock bug test:

$ env x='() { :;}; echo vulnerable' bash -c "echo this is a test"

See http://www.kb.cert.org/vuls/id/252743 for information on the Shellshock bug.

-- 
Peter Barada
address@hidden

bash-4.3.tar.gz.md5
Description: application/md5

bash-4.3-001-025.patch.md5
Description: application/md5

bash-4.3-001-025.patch
Description: Text Data

bash.spec
Description: Text Data