CODEWITHSUNDEEP
bashshellshock-bash-bug
JRR
JRR

Reputation: 6152

patching bash shell shock bug from source

I am running a non-standard version of Ubuntu and I tried to patch the shell shock bug by downloading and recompiling from the source, following the instructions from https://news.ycombinator.com/item?id=8364385 . After make install, running bash --version shows 4.3.24(2). But when running the bug test:

env var='() { :;}; echo vulnerable' bash -c /bin/true

is still printing vulnerable . Am I doing something wrong?

Upvotes: 1

Views: 217

Answers (2)

rici
rici

Reputation: 241911

It's most likely that you didn't install the new bash in the right place. Or that you didn't manage to install it at all.

make install will only work if you're running as root. Normally, you would need to do

sudo make install

If you don't, you'll see an error message:

$ make install

          ***********************************************************
          *                                                         *
          * GNU bash, version 4.3.25(1)-release (x86_64-unknown-linux-gnu)
          *                                                         *
          ***********************************************************

mkdir -p -- /usr/local/share/doc/bash
mkdir: cannot create directory ‘/usr/local/share/doc/bash’: Permission denied
make: *** [installdirs] Error 1

which means that the software wasn't installed. (You only need to redo the install step.)

Also, by default, the bash build files will install your new bash as /usr/local/bin/bash, while your old bash will continue to exist in /usr/bin/bash. Check which bash is being run by typing:

which bash

Upvotes: 0

chepner
chepner

Reputation: 532093

4.3.24 is from August 2014; you need 4.3.25.

Upvotes: 1

Related Questions