11

We are running Debian Etch, Lenny and Squeeze because upgrades have never been done in this shop; we have over 150 systems running various Debian versions. In light of the "shell shock" of this week, I assume I need to upgrade bash. I do not know Debian so I am concerned.

Can I merely execute apt-get install bash on all of my Debian systems and get the correct Bash package while my repository is pointed at a Squeeze entry. If not, what other course of action do I have?

  • 7
    you could selectively backport bash to those systems. it will probably run ok on them. But you really, really, should upgrade. You realise anything older than oldstable doesn't have security updates, right?And bear in mind this security vulnerability is only one of many. – Faheem Mitha Sep 26 '14 at 20:10
  • Is it even a problem? What's the system shell on that system? (That is, the shell you get when you run the system POSIX call, which is /bin/sh). If /bin/sh is bash, then you need to update. If it's not... Then you're probably fine (but you should update bash itself anyway) – Arafangion Jan 2 '18 at 23:52
11

You have the option to just upgrade bash. To do so use the following apt-get command:

apt-get update

Then after the update fetches all of the available updates run:

apt-get install --only-upgrade bash

To get updates on older releases, Squeeze for example, you will probably need to add the Squeeze-LTS repo to your sources.list.

To add this repository, edit /etc/apt/sources.list and add the following line to the end of the file.

deb http://ftp.us.debian.org/debian squeeze-lts main non-free contrib

To check a particular system for the vulnerabilities (or see if the upgrade works) you can check the bash versions that you are using and see if the version is affected (it probably is) or there are numerous shell test scripts available on the web.

EDIT 1

To upgrade bash on Lenny or Etch, take a look at Ilya Sheershoff's answer below for how to compile bash from source and manually upgrade the version of bash that your release is using.

EDIT 2

Here is an example sources.list file from a Squeeze server I successfully upgraded:

deb http://ftp.us.debian.org/debian/ squeeze main
deb-src http://ftp.us.debian.org/debian/ squeeze main

deb http://security.debian.org/ squeeze/updates main
deb-src http://security.debian.org/ squeeze/updates main

# squeeze-updates, previously known as 'volatile'
deb http://ftp.us.debian.org/debian/ squeeze-updates main
deb-src http://ftp.us.debian.org/debian/ squeeze-updates main

# Other - Adding the lsb source for security updates
deb http://http.debian.net/debian/ squeeze-lts main contrib non-free
deb-src http://http.debian.net/debian/ squeeze-lts main contrib non-free
  • A newbie might not know they have to run apt-get update first, to get the latest catalog of packages. – Brenda J. Butler Sep 30 '14 at 15:36
  • I had to use: deb ftp.us.debian.org/debian squeeze main contrib to upgrade bash to version 4.1-3 and then use the patched sources to make it not vulnerable. – user86289 Oct 1 '14 at 10:46
  • @BrendaJ.Butler Good suggestion, I added that step as well. – datUser Oct 1 '14 at 19:52
4

If the apt-get install option didn't work, you'll need to recompile the bash from sources. Lenny and Etch examples are in the answer. I haven't got any Squeeze machines, but one can easily figure out what to do.

The solution from TaNNkoST I've found on the net:

Check the number of patches available and change the number in the "(seq" part if there are new ones.

FOR LENNY

#first find out the version you have so you know what to get for the patches and source files
dpkg-query -l|grep bash
ii bash 4.1-3 The GNU Bourne Again SHell

#do this in the /usr/src dir
cd /usr/src
wget http://ftp.gnu.org/gnu/bash/bash-4.1.tar.gz
tar zxvf bash-4.1.tar.gz
cd bash-4.1

# fetch all patches, including latest ones that patches CVE-2014-6271
for i in $(seq -f "%03g" 0 14); do
wget -nv http://ftp.gnu.org/gnu/bash/bash-4.1-patches/bash41-$i
patch -p0 < bash41-$i
done

# check if yacc is installed. if not - install yacc
apt-get install bison

# configure,compile and install bash (this will install bash into /usr/local/bin/bash)
./configure && make
make install

# make a symlink from /bin/bash to the new binary
mv /bin/bash /bin/bash.old
ln -s /usr/local/bin/bash /bin/bash

# check that you're not vulnerable anymore wiith the output of the following
# it should not output vulnerable word anymore
env x='() { :;}; echo vulnerable' bash -c echo

#you can  Delete the old one thats a problem
rm /bin/bash.old

FOR ETCH I've followed the same logic, but I haven't got yacc installed on the system so I had to install bison package for that. Here's what I came up with:

#first find out the version you have so you know what to get for the patches and source files
dpkg-query -l|grep bash
ii bash 3.2-4 The GNU Bourne Again SHell

#do this in the /usr/src dir
cd /usr/src
wget http://ftp.gnu.org/gnu/bash/bash-3.2.tar.gz
tar zxvf bash-3.2.tar.gz
cd bash-3.2

# fetch all patches, including latest ones that patches CVE-2014-6271
for i in $(seq -f "%03g" 0 54); do
wget -nv http://ftp.gnu.org/gnu/bash/bash-3.2-patches/bash32-$i
patch -p0 < bash32-$i
done

# check if yacc is installed. if not - install yacc
apt-get install bison

# configure,compile and install bash (this will install bash into /usr/local/bin/bash)
./configure && make
make install

# at this point my system is not vulnerable already, test your system
env VAR='() { :;}; echo Bash is vulnerable!' bash -c "echo Bash Test"

# if this is not the case for your system - try the following

# make a symlink from /bin/bash to the new binary
mv /bin/bash /bin/bash.old
ln -s /usr/local/bin/bash /bin/bash

# check that you're not vulnerable anymore wiith the output of the following
# it should not output vulnerable word anymore
env x='() { :;}; echo vulnerable' bash -c echo

#you can Delete the old one thats a problem
rm /bin/bash.old
  • 1
    I found I got the error make: yacc: Command not found for the Lenny solution, and fixed it by using apt-get install bison. – SharpC Oct 15 '14 at 12:08
1

Not sure if you want to trust these packages but someone has built packages for woody (3.0), sarge (3.1), etch (4.0) and lenny (5.0). They're available here:

http://blog.bofh.it/debian/id_451

Be careful, there is no repository for installing these packages via apt-get. You need to use dpkg or create your own local repository.

  • "if you want to trust these packages"? They're signed with the GPG key of a Debian Developer. Just like any other official Debian package. – peppe Oct 15 '14 at 13:09
0

To update Bash on many different OS, you can use the universal script Deshellshock.

protected by Community Oct 5 '14 at 1:12

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.