0

The question on this site: "When was the shellshock (CVE-2014-6271/7169) bug introduced, and what is the patch that fully fixes it?" explains how the vulnerability has been cured, but does not, as far as I can see, explain what is necessary for individuals to do on their own computers. Is there any need for further action if yum -y update bash gives No packages marked for update.?

closed as unclear what you're asking by Gilles, Networker, Michael Homer, Anthon, bsd Oct 4 '14 at 8:44

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • Does rpm -qv bash show that you have the most recently updated version installed? – Timothy Martin Oct 3 '14 at 18:38
  • 1
    To help decide if whether you need to do more, you can, quite easily, test your bash to see if it is vulnerable. – John1024 Oct 3 '14 at 18:44
  • 5
    I don't really understand why we need a special question for this. It's like any bug in any program -- keep it updated via your package manager – Michael Mrozek Oct 3 '14 at 19:03
  • 1
    I feel the a couple of these comments are a little unkind. Ok if you are an expert, but for one who is an eternal newbie this was a valid question. I wanted to know if there is more than the obvious to be done. How do I know if my bash is the most up-to-date other than by using yum? – Harry Weston Oct 3 '14 at 19:26
  • 1
    I would say my question is perfectly clear, here it is again: "Is there any need for further action if yum -y update bash gives No packages marked for update.?" – Harry Weston Oct 4 '14 at 10:46
3

Following the comments,I have done this, and am satisfied that I am up-to-date.

[Harry@localhost]~% rpm -qv bash 
bash-4.2.48-2.fc20.i686
[Harry@localhost]~% env X='() { (a)=>\' sh -c "echo date"; cat echo
date
cat: echo: No such file or directory
[Harry@localhost]~%
  • 1
    +1. Also, if you could add a link where it says the vulnerability is fixed on this particular bash version, it would be great. – Ramesh Oct 3 '14 at 19:31
  • 3
    If you're looking to test that vulnerabilities are fixed, there are quite a few others to run: shellshocker.net – Michael Mrozek Oct 3 '14 at 19:49
  • Answering Ramesh -- sorry, that's another thing I found difficult and gave up on. Just a bewildering lot of information that it needs an experienced expert to understand, also one who is not dismissive of enquiries, and is capable of explaining it all in clear non-jargon terms. As a final result, I just assume that if I keep updating bash the problem won't affect me. – Harry Weston Oct 4 '14 at 9:51

Not the answer you're looking for? Browse other questions tagged or ask your own question.