Support NeoGAF

[batteryLeakage]

vulnerable
this is a test

how do i update my bash shell? in OS X terminal?

Apple might push out a security update soon (not sure how responsive they are to these sort of things) but you can build the newest version of bash yourself if you want. You can download XCode (need register with Apple at https://developer.apple.com/ ) and then follow the instructions in the link below.

https://apple.stackexchange.com/questions/146849/how-do-i-recompile-bash-to-avoid-the-remote-exploit-cve-2014-6271-and-cve-2014-7/146851#146851

 

[BlackGoku03]

I got notification this morning from work. I don't have any Linux based servers at my site so I'm good. We do use them for other servers hosted elsewhere... not my problem though.

 

[Technosteve]

This seems to work if you have xcode installed:

http://apple.stackexchange.com/questions/146849/how-do-i-recompile-bash-to-avoid-the-remote-exploit-cve-2014-6271-and-cve-2014-7

shit i have xcode uninstalled, why couldn't this just be a brew package i update =(

 

[The Faceless Master]

If anyone was wondering, DD-WRT uses Busybox and not bash so it's safe.

*wipes brow*

 

[Cizeta-Moroder]

Okay so... I'm a bit of a noob.
I have Nokia N900 with Maemo, which apparently doesn't have this bash thing by default. Running the command in X Terminal returned

-sh: bash: not found

But on the other hand, I have Easydebian environment installed on it. With debbie it returned

vulnerable
this is a test

I assume I'm still safe when operating outside the Debian environment? Should I worry as I use regularly Libreoffice under the Debian LXDE? Maemo and Easydebian have a strong community, but I'm not all that confident in my ability to update this thing.

 

[belvedere]

Assuming this won't affect esxi.

 

[cooljeanius]

shit i have xcode uninstalled, why couldn't this just be a brew package i update =(

Both Homebrew and MacPorts already have their copies bash patched (haven't seen an update for Fink's yet though), so you could just update one of those and then set that as your default shell. The Xcode instructions are just for replacing your system, Apple-provided copy of bash. Actually, on second thought, even if you go the package manager route, I'm pretty sure Homebrew/MacPorts/Fink etc. all require you to have Xcode installed anyways to build anything from source, so idk how the package manager route would really be that much easier if you have Xcode uninstalled...

 

[Blizzard]

Yes there is. Most systems have one.

Like Linux distributions? Can you do a "ls -l /bin/sh" out of curiosity? Which distro do you have?

*edit* On another note, I'm seeing people say that the bash patch may not have fixed all the environment variable vulnerabilities and they're still investigating.

 

[Jezbollah]

BBC are reporting attacks happening now due to the exploit

http://www.bbc.com/news/technology-29375636

 

[LoveCake]

I'm surprised this thread isn't getting more replies. It's a huge potential threat, but I guess GAFers are more concerned about their phones bending.

Just spent an hour educating myself about different Linux shells and trying to find out if my router at home is vulnerable. At work, so can't do the test.

I am wondering this myself, anyone know what can be done if their router is at risk?

 

[Sapiens]

I have two websites on VPSs - one is 14.04 so it's fine after an update, but the other is 10.10 and an update to the shell is not available.

FUCK, I don't want to have to upgrade it as it's already running on bare min specs. Oh well.

 

[seb_n]

Assuming this won't affect esxi.

http://kb.vmware.com/selfservice/mi...nguage=en_US&cmd=displayKC&externalId=2090740

esxi is fine.

 

[Valkyr Junkie]

Soooo glad I work in a Windows shop today.

Hope nobody is running cygwin.

 

[GungHo]

I'm surprised this thread isn't getting more replies. It's a huge potential threat, but I guess GAFers are more concerned about their phones bending.

It's a gaming site with interest in end user devices and pop culture, not a corporate security admin site. If you ask these people what a jump box is, they're going to think it's some shit you do to a console, and they think passing the hash is a drug reference.

 

[Sapiens]

So, I need a little help.

My Ubuntu 10.10 server is mainly there to run a couple rails apps (apache, passenger, sqlite) so nothing crazy. I`ve got a a little traffic going through it, but nothing crazy.

Any way, server admin is not my forte - I can install stuff, configure a little, but I`m not super familiar with back up and restore process.

What I want to know is if there is a way to back up the entirey of that VPS (including running services, etc) to a local file via SSH, reinstal a newer version of ubuntu, and then restore the files and services.

Any help is appreciated.

 

[KHarvey16]

So, I need a little help.

My Ubuntu 10.10 server is mainly there to run a couple rails apps (apache, passenger, sqlite) so nothing crazy. I`ve got a a little traffic going through it, but nothing crazy.

Any way, server admin is not my forte - I can install stuff, configure a little, but I`m not super familiar with back up and restore process.

What I want to know is if there is a way to back up the entirey of that VPS (including running services, etc) to a local file via SSH, reinstal a newer version of ubuntu, and then restore the files and services.

Any help is appreciated.

I thought the fix was to just patch bash?

 

[Sapiens]

I thought the fix was to just patch bash?

10.10 is not supported anymore. Apt-get update/apt-get install bash does't fix it.

Everything went fine on my Ubuntu 14 VPS

 

[tfur]

Just an FYI, there has been another bash update since the last 24 hours for Redhat/CentOS.

 

[Sapiens]

Found a fix for Ubuntu 10.10
http://techblog.willshouse.com/2014...bash-on-ubuntu-10-10-maverick-fix-shellshock/

Just make sure you log in as root

Here's another if you're 8.04
http://techblog.willshouse.com/2014...bash-on-ubuntu-10-10-maverick-fix-shellshock/

I'm all good!

 

[MartyStu]

Like Linux distributions? Can you do a "ls -l /bin/sh" out of curiosity? Which distro do you have?

*edit* On another note, I'm seeing people say that the bash patch may not have fixed all the environment variable vulnerabilities and they're still investigating.

Took a look at my servers, and you are absolutely correct.

10.10 is not supported anymore. Apt-get update/apt-get install bash does't fix it.

Everything went fine on my Ubuntu 14 VPS

Build it from source.

Edit: Oops, looks like you did.

 

[infiniteloop]

Apple have released a patch for OS X

http://support.apple.com/kb/DL1769?viewlocale=en_US&locale=en_US

 

[OmegaFax]

Apple have released a patch for OS X

http://support.apple.com/kb/DL1769?viewlocale=en_US&locale=en_US

Thanks for posting that. Updated.

http://mac-how-to.wonderhowto.com/h...lshock-bash-exploit-heres-patch-os-x-0157606/ << This is what I used to patch Bash last week. Was just about to do this again before I caught your post.

 

[cooljeanius]

Apple have released a patch for OS X

http://support.apple.com/kb/DL1769?viewlocale=en_US&locale=en_US

Only for Mavericks? wtf, this affects older versions of OS X, too, which some people still have good reason to use...

 

[Guess Who]

Only for Mavericks? wtf, this affects older versions of OS X, too, which some people still have good reason to use...

Also available for Mountain Lion:

http://support.apple.com/kb/DL1768

And Lion:

http://support.apple.com/kb/DL1767

 

[Stumpokapow]

Only for Mavericks? wtf, this affects older versions of OS X, too, which some people still have good reason to use...

There's... not really any reason to run OSX server at all at this point, honestly. The XSan isn't a best-in-breed storage solution, XServe doesn't exist, and in the virtualization era any virtualized shard of any server hardware is going to outperform a Mac Mini, and almost no one needs ONE POWERHOUSE server instance for the Mac Pro.

 

[cooljeanius]

There's... not really any reason to run OSX server at all at this point, honestly. The XSan isn't a best-in-breed storage solution, XServe doesn't exist, and in the virtualization era any virtualized shard of any server hardware is going to outperform a Mac Mini, and almost no one needs ONE POWERHOUSE server instance for the Mac Pro.

I said "older versions"; I didn't mention anything about the server edition...

 

[Jezbollah]

Morning all.

I have updated the OP with links kindly provided by Jobiensis, Sapiens, infiniteloop and Guess Who. Thank you very much.