I upgraded my old Debian 6.0 (Squeeze) server, but still the vulnerability seems to be there:
$ env x='() { :;}; echo vulnerable' bash -c 'echo hello'
vulnerable
hello
How do I upgrade Bash to a newer version on Debian 6.0 (Squeeze)?
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.
Sign up to join this communityI upgraded my old Debian 6.0 (Squeeze) server, but still the vulnerability seems to be there:
$ env x='() { :;}; echo vulnerable' bash -c 'echo hello'
vulnerable
hello
How do I upgrade Bash to a newer version on Debian 6.0 (Squeeze)?
To get updates on older releases you will probably need to add the Debian 6.0 (Squeeze) LTS repository to your sources.list
.
To add this repository, edit /etc/apt/sources.list
and add the following line to the end of the file.
deb http://ftp.us.debian.org/debian squeeze-lts main non-free contrib
Then run:
apt-get update
You should see some new sources in the list of repositories now as the update is running. Now just:
apt-get install --only-upgrade bash
Here is a listing of my sources.list
file from a Squeeze server I just upgraded:
deb http://ftp.us.debian.org/debian/ squeeze main
deb-src http://ftp.us.debian.org/debian/ squeeze main
deb http://security.debian.org/ squeeze/updates main
deb-src http://security.debian.org/ squeeze/updates main
# squeeze-updates, previously known as 'volatile'
deb http://ftp.us.debian.org/debian/ squeeze-updates main
deb-src http://ftp.us.debian.org/debian/ squeeze-updates main
# Other - Adding the lsb source for security updates
deb http://http.debian.net/debian/ squeeze-lts main contrib non-free
deb-src http://http.debian.net/debian/ squeeze-lts main contrib non-free
The following packages have unmet dependencies: libc6-dev : Breaks: gcc-4.4 (< 4.4.6-4) but 4.4.5-8 is to be installed E: Broken packages
You must use the squeeze-lts
repository in order to continue receiving updates to Debian Squeeze
To add this repository, edit /etc/apt/sources.list
and add the line
deb http://ftp.us.debian.org/debian squeeze-lts main non-free contrib
(you can remove non-free
and contrib
if desired)
To update only bash, after running apt-get update
use apt-get install bash
to install just bash, instead of a complete upgrade.