Re: Fwd: SANS FLASH REPORT: The Shellshock vulnerability: What you should do now.

Noong 27/09/2014 01:05 sinulat ni andrelst

> More information below. But take note, some Patches below are partial fix and another patch is needed to fully fix it.
>
> To complicate things, Redhat investigation of source code found another issue in the bash parser, and  is developing another patch to fix it too.
>
> So, there you go. 1,2 3 punch for bash. So, some of the links may have incorporated 1 or only 2 patches. The only one that i know of, that incorporates all 3 patches is Debian. Probably redhat, have not personally verified yet.
>
> Debian - fix - https://www.debian.org/security/2014/dsa-3035 https://www.debian.org/security/2014/dsa-3032
>
> CentOS - fix - http://centosnow.blogspot.com/2014/09/critical-bash-updates-for-centos-5.html
>
> RedHat - fix - https://rhn.redhat.com/errata/RHSA-2014-1293.html & https://access.redhat.com/articles/1200223
>
> Novell/SUSE - fix - http://support.novell.com/security/cve/CVE-2014-6271.html
>
> Oracle Linux - fix - http://linux.oracle.com/cve/CVE-2014-6271.html
>
> AIX    - none yet - PMR has been created. But, default installation for AIX bash is not part of it unless you install AIX Linux Toolbox.

IBM has already released the patch for AIX:

http://www-01.ibm.com/support/docview.wss?uid=isg3T1021272

and for those who still use RHEL4/CENTOS4:

https://oss.oracle.com/el4/SRPMS-updates/




> HP-UX - don't know
>
> Solaris    - fix - IDR patch for Solaris 8 to 11. none for Solaris 7 and below, but it's an easy recompile from source. https://support.oracle.com
>


_________________________________________________
Philippine Linux Users' Group (PLUG) Mailing List
http://lists.linux.org.ph/mailman/listinfo/plug
Searchable Archives: http://archives.free.net.ph