Legacy Debian versions and Bash Shellshock

Question

We are running Debian Etch, Lenny and Squeeze because upgrades have never been done in this shop; we have over 150 systems running various Debian versions. In light of the "shell shock" of this week, I assume I need to upgrade bash. I do not know Debian so I am concerned.

Can I merely execute apt-get install bash on all of my Debian systems and get the correct Bash package while my repository is pointed at a Squeeze entry. If not, what other course of action do I have?

Answer 1

You have the option to just upgrade bash. To do so use the following apt-get command:

apt-get update

Then after the update fetches all of the available updates run:

apt-get install --only-upgrade bash

To get updates on older releases, Squeeze for example, you will probably need to add the Squeeze-LTS repo to your sources.list.

To add this repository, edit /etc/apt/sources.list and add the following line to the end of the file.

deb http://ftp.us.debian.org/debian squeeze-lts main non-free contrib

To check a particular system for the vulnerabilities (or see if the upgrade works) you can check the bash versions that you are using and see if the version is affected (it probably is) or there are numerous shell test scripts available on the web.

EDIT 1

To upgrade bash on Lenny or Etch, take a look at Ilya Sheershoff's answer below for how to compile bash from source and manually upgrade the version of bash that your release is using.

EDIT 2

Here is an example sources.list file from a Squeeze server I successfully upgraded:

deb http://ftp.us.debian.org/debian/ squeeze main
deb-src http://ftp.us.debian.org/debian/ squeeze main

deb http://security.debian.org/ squeeze/updates main
deb-src http://security.debian.org/ squeeze/updates main

# squeeze-updates, previously known as 'volatile'
deb http://ftp.us.debian.org/debian/ squeeze-updates main
deb-src http://ftp.us.debian.org/debian/ squeeze-updates main

# Other - Adding the lsb source for security updates
deb http://http.debian.net/debian/ squeeze-lts main contrib non-free
deb-src http://http.debian.net/debian/ squeeze-lts main contrib non-free

Answer 2

If the apt-get install option didn't work, you'll need to recompile the bash from sources. Lenny and Etch examples are in the answer. I haven't got any Squeeze machines, but one can easily figure out what to do.

The solution from TaNNkoST I've found on the net:

Check the number of patches available and change the number in the "(seq" part if there are new ones.

FOR LENNY

#first find out the version you have so you know what to get for the patches and source files
dpkg-query -l|grep bash
ii bash 4.1-3 The GNU Bourne Again SHell

#do this in the /usr/src dir
cd /usr/src
wget http://ftp.gnu.org/gnu/bash/bash-4.1.tar.gz
tar zxvf bash-4.1.tar.gz
cd bash-4.1

# fetch all patches, including latest ones that patches CVE-2014-6271
for i in $(seq -f "%03g" 0 14); do
wget -nv http://ftp.gnu.org/gnu/bash/bash-4.1-patches/bash41-$i
patch -p0 < bash41-$i
done

# check if yacc is installed. if not - install yacc
apt-get install bison

# configure,compile and install bash (this will install bash into /usr/local/bin/bash)
./configure && make
make install

# make a symlink from /bin/bash to the new binary
mv /bin/bash /bin/bash.old
ln -s /usr/local/bin/bash /bin/bash

# check that you're not vulnerable anymore wiith the output of the following
# it should not output vulnerable word anymore
env x='() { :;}; echo vulnerable' bash -c echo

#you can  Delete the old one thats a problem
rm /bin/bash.old

FOR ETCH I've followed the same logic, but I haven't got yacc installed on the system so I had to install bison package for that. Here's what I came up with:

#first find out the version you have so you know what to get for the patches and source files
dpkg-query -l|grep bash
ii bash 3.2-4 The GNU Bourne Again SHell

#do this in the /usr/src dir
cd /usr/src
wget http://ftp.gnu.org/gnu/bash/bash-3.2.tar.gz
tar zxvf bash-3.2.tar.gz
cd bash-3.2

# fetch all patches, including latest ones that patches CVE-2014-6271
for i in $(seq -f "%03g" 0 54); do
wget -nv http://ftp.gnu.org/gnu/bash/bash-3.2-patches/bash32-$i
patch -p0 < bash32-$i
done

# check if yacc is installed. if not - install yacc
apt-get install bison

# configure,compile and install bash (this will install bash into /usr/local/bin/bash)
./configure && make
make install

# at this point my system is not vulnerable already, test your system
env VAR='() { :;}; echo Bash is vulnerable!' bash -c "echo Bash Test"

# if this is not the case for your system - try the following

# make a symlink from /bin/bash to the new binary
mv /bin/bash /bin/bash.old
ln -s /usr/local/bin/bash /bin/bash

# check that you're not vulnerable anymore wiith the output of the following
# it should not output vulnerable word anymore
env x='() { :;}; echo vulnerable' bash -c echo

#you can Delete the old one thats a problem
rm /bin/bash.old

Answer 3

Not sure if you want to trust these packages but someone has built packages for woody (3.0), sarge (3.1), etch (4.0) and lenny (5.0). They're available here:

http://blog.bofh.it/debian/id_451

Be careful, there is no repository for installing these packages via apt-get. You need to use dpkg or create your own local repository.

Answer 4

To update Bash on many different OS, you can use the universal script Deshellshock.