Critical bash bug - remote code execution.

[Devnul]

http://lcamtuf.blogspot.de/2014/09/bash-bug-apply-unofficial-patch-now.html

 

Most of popular distributions already have patch, so remember APT-GET UPGRADE baby!

[revi]

Or whatever command your distribution uses for upgrades...

 

We're not all using debian-based distro's

[Devnul]

I know revi, just saying "remeber to update your OS".

 

[hussam]

http://ftp.gnu.org/gnu/bash/bash-4.3-patches/

patches .25 and up are the security fixes for this if you are running bash 4.3

[Elke]

Do not panic, if you don't run a server. For desktop computers which you use alone or only by trusted people this bug is not that severe as there's most likely no attack vector, save maybe java in your browser, which is an attack vector no matter what. For a remote attacker to exploit it, you must have running a service which allows execution of (unpriviliged) shell code. This can possibly be done indirectly via some other service like a web service with forms which are parsed or similar. But that's generally not the case on desktops.

 

Also, every reasonable distribution has fixed it meanwhile, most fixed it within hours. And it should be part of the usual updates one receives (and you always install updates when your system notifies you, don't you? ).

Edited October 2, 2014 by Elke

[hussam]

Still more exploits being fixed. patch 30 for bash 4.3 released yesterday.

[Devnul]

DO NOT PANIC! Said Yahoo administrator and ...

 

http://webcache.googleusercontent.com/search?q=cache%3Awww.futuresouth.us%2Fyahoo_hacked.html

Website from cache, since the original one goes up and down, I wonder why ... NOT!

 

Original: http://www.futuresouth.us/yahoo_hacked.html

[hussam]

DO NOT PANIC! Said Yahoo administrator and ...

 

http://webcache.googleusercontent.com/search?q=cache%3Awww.futuresouth.us%2Fyahoo_hacked.html

Website from cache, since the original one goes up and down, I wonder why ... NOT!

 

Original: http://www.futuresouth.us/yahoo_hacked.html

 

Yahoo runs web services. They are open to exploits.

You are more or less safe if you don't have services that listen to the outside world on your personal computer.

 

Those bugs are due to the lack of code auditing so it is good that they are being found and addressed.