<html><body><div style="font-family: Arial; font-size: 12pt; color: #000000"><div>http://www.itnews.com.au/News/396197,first-shellshock-botnet-attacks-akamai-us-dod-networks.aspx?eid=3&edate=20140926&utm_source=20140926_PM&utm_medium=newsletter&utm_campaign=daily_newsletter</div><div><br></div><div><br></div><hr id="zwchr"><div style="color:#000;font-weight:normal;font-style:normal;text-decoration:none;font-family:Helvetica,Arial,sans-serif;font-size:12pt;"><b>From: </b>"BillK" <billk@iinet.net.au><br><b>To: </b>plug@plug.org.au<br><b>Sent: </b>Friday, 26 September, 2014 1:33:20 PM<br><b>Subject: </b>Re: [plug] Bash vulnerability<br><div><br></div>Gentoo listed an advisory yesterday so I updated the bulk of machines and vm's. This morniing they reissued it with another version as it didn't properly fix the problem ... Have to do it all over again tonight :(<br>
<br>
Have not heard of an exploit in the wild yet ...<br><div><br></div><div class="gmail_quote">On 26 September 2014 1:08:20 pm AWST, Brad Campbell <brad@fnarfbargle.com> wrote:<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<pre class="k9mail">On 25/09/14 11:00, Brad Campbell wrote:<br><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #729fcf; padding-left: 1ex;"> So I did the right thing and went and ensured all our servers were<br> appropriately patched, however I individually tested each one first.<br><div><br></div> We are running various version of Debian and Ubuntu with some VM's<br> dating back to Debian 5 and Ubuntu 10.04LTS all the way to current for<br> both. None of these had a version of bash that responded at all to the<br> test exploit being posted around. How odd.<br><div><br></div> My western digital mybook is vulnerable however.<br></blockquote><br>Ok, so that is solved.<br>I used this line from an article at <a href="http://Theregister.co.uk" target="_blank">Theregister.co.uk</a> :<br><div><br></div>env X="() { :;} ; echo busted" /bin/sh -c "echo stuff"<br><div><br></div>Anyone see the obvious problem with it when used on Debian systems?<br>That's right Freddie, Debian
has /bin/bash and /bin/sh and they are <br>different interpreters. On my systems /bin/sh points to dash.<br><div><br></div>Changing that to :<br><div><br></div>env X="() { :;} ; echo busted" /bin/bash -c "echo stuff"<br><div><br></div>shows my remaining unpatched systems are vulnerable.<br><div><br></div>I'll put the brown paper bag on now.<br><div><br></div><hr><br>PLUG discussion list: plug@plug.org.au<br><a href="http://lists.plug.org.au/mailman/listinfo/plug" target="_blank">http://lists.plug.org.au/mailman/listinfo/plug</a><br>Committee e-mail: committee@plug.org.au<br>PLUG Membership: <a href="http://www.plug.org.au/membership" target="_blank">http://www.plug.org.au/membership</a><br></pre></blockquote></div><br>
-- <br>
Sent from my Android phone with K-9 Mail. Please excuse my brevity.<br>_______________________________________________<br>PLUG discussion list: plug@plug.org.au<br>http://lists.plug.org.au/mailman/listinfo/plug<br>Committee e-mail: committee@plug.org.au<br>PLUG Membership: http://www.plug.org.au/membership</div><div><br></div></div></body></html>