On Friday 26 September 2014 14:05:01 Michael D. Setzer II wrote:
> I download the
> ftp://ftp.gnu.org/gnu/bash/bash-4.3.tar.gz
> and the patches in
> ftp://ftp.gnu.org/gnu/bash/bash-4.3-patches/
>
> Installed the 25 patches and then build the code.
> Running the test on that version of bash passes the test.
>
> Don't know if there would be any issues with then replacing the older bash
> on a system with the newly build one, but that didn't take much time to
> build.
Tried this and it appears that this version of BASH is still vulnerable
[root@test bash-4.3]# ./bash
[root@test bash-4.3]# echo $BASH_VERSION
4.3.25(1)-release
[root@test bash-4.3]# env x='() { :;}; echo vulnerable' bash -c "echo this is
a test"
vulnerable
this is a test
[root@test bash-4.3]#
--
users mailing list
users@lists.fedoraproject.org
To unsubscribe or change subscription options:
https://admin.fedoraproject.org/mailman/listinfo/users
Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct
Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines
Have a question? Ask away: http://ask.fedoraproject.org
