Linux bash vulnerability

[Unix]

All bash is, even on SPARC Solaris.

Ubuntu users dash as its shell.

[suityou01]

All bash is, even on SPARC Solaris.

Yep. Apart from Ubuntu and Debian flavours. Please don't make me say it again.

[administrator]

CGI scripts? How very 1990's. How many servers are you running that might be affected Suity? None? At ease then, soldier.

[suityou01]

CGI scripts? How very 1990's. How many servers are you running that might be affected Suity? None? At ease then, soldier.

Quoted for posterity.

[stek]

Yep. Apart from Ubuntu and Debian flavours. Please don't make me say it again.

Yes but bash is installable on said Unix-like operating systems and probably is installed under the mass of crap that gets shovelled in with a 'default' install on these OS's but isn't the default shell, and might never be invoked by a user but it's still there.

It's not like Ubuntu just gets dash (thanks Unix) or IRIX just gets zsh, is it?

I spent all today trawling through various Unixes and Unix-like OS's and you can't assume that because AIX doesn't come with bash it's not been added or because we all prefer ksh on Solaris and HP-UX bash isn't there either.

[CheeseSlice]

It's been out there for 20 years yet no-one has exploited it yet, funny that. It's storm in a teacup.

It probably has been exploited, but those who've been doing it have kept quiet.

[administrator]

From what I can see it reads a bit like the heartbleed thing from earlier in the year. That was a storm in a tea-cup. Checking and patching machines keeps a lot of bods in works. Worryworts such as yourself help to maintain management's need for this. Keep up the good work, your contribution to the cause is greatly appreciated.

[stek]

From what I can see it reads a bit like the heartbleed thing from earlier in the year. That was a storm in a tea-cup. Checking and patching machines keeps a lot of bods in works. Worryworts such as yourself help to maintain management's need for this. Keep up the good work, your contribution to the cause is greatly appreciated.

Too right, we're in Change Control/Downtime hell now, be weeks before anything's done lol!

[suityou01]

From what I can see it reads a bit like the heartbleed thing from earlier in the year. That was a storm in a tea-cup. Checking and patching machines keeps a lot of bods in works. Worryworts such as yourself help to maintain management's need for this. Keep up the good work, your contribution to the cause is greatly appreciated.

Maybe so. I hope you're right but I think you're assuming a cgi exploit is the only possible attack vector.

I agree with the analysts, we ain't seen nothing yet.

[administrator]

Yes but bash is installable on said Unix-like operating systems and probably is installed under the mass of crap that gets shovelled in with a 'default' install on these OS's but isn't the default shell, and might never be invoked by a user but it's still there.

It's not like Ubuntu just gets dash (thanks Unix) or IRIX just gets zsh, is it?

I spent all today trawling through various Unixes and Unix-like OS's and you can't assume that because AIX doesn't come with bash it's not been added or because we all prefer ksh on Solaris and HP-UX bash isn't there either.

Aye, as I understand it on Ubuntu dash is the default but bash is still there. But best ask Suity, he is the expert on these things