I upgraded my old Debian 6.0 (Squeeze) server, but still the vulnerability seems to be there:
$ env x='() { :;}; echo vulnerable' bash -c 'echo hello'
vulnerable
hello
How do I upgrade Bash to a newer version on Debian 6.0 (Squeeze)?
-
did you start a new bash shell? – Anthon Sep 26 '14 at 20:34
Add a comment
|
To get updates on older releases you will probably need to add the Debian 6.0 (Squeeze) LTS repository to your sources.list.
To add this repository, edit /etc/apt/sources.list and add the following line to the end of the file.
deb http://ftp.us.debian.org/debian squeeze-lts main non-free contrib
Then run:
apt-get update
You should see some new sources in the list of repositories now as the update is running. Now just:
apt-get install --only-upgrade bash
Here is a listing of my sources.list file from a Squeeze server I just upgraded:
deb http://ftp.us.debian.org/debian/ squeeze main
deb-src http://ftp.us.debian.org/debian/ squeeze main
deb http://security.debian.org/ squeeze/updates main
deb-src http://security.debian.org/ squeeze/updates main
# squeeze-updates, previously known as 'volatile'
deb http://ftp.us.debian.org/debian/ squeeze-updates main
deb-src http://ftp.us.debian.org/debian/ squeeze-updates main
# Other - Adding the lsb source for security updates
deb http://http.debian.net/debian/ squeeze-lts main contrib non-free
deb-src http://http.debian.net/debian/ squeeze-lts main contrib non-free
-
-
OK, when I do this (with wheezy instead of squeeze), I get
The following packages have unmet dependencies: libc6-dev : Breaks: gcc-4.4 (< 4.4.6-4) but 4.4.5-8 is to be installed E: Broken packages– rubo77 Sep 26 '14 at 19:53 -
2Nope. Here is a test script that I have been running to check for both: gist.github.com/KalenAnson/231db4b468fc53a5ae7d – 111--- Sep 26 '14 at 20:23
-
1You have to do some more after adding the LTS source: wiki.debian.org/LTS/Using#Using_Debian_squeeze_.286.0.29_LTS – rubo77 Sep 27 '14 at 5:25
-
1the script you were using to test, seems to show always positive, see the issue in this alternative test: github.com/hannob/bashcheck/issues/6#issuecomment-57081774 – rubo77 Sep 28 '14 at 19:31
You must use the squeeze-lts repository in order to continue receiving updates to Debian Squeeze
To add this repository, edit /etc/apt/sources.list and add the line
deb http://ftp.us.debian.org/debian squeeze-lts main non-free contrib
(you can remove non-free and contrib if desired)
To update only bash, after running apt-get update use apt-get install bash to install just bash, instead of a complete upgrade.
