Hacker News Reader

Comment by mrmondo | Hacker News Reader

Debian patched this 8 hours ago, Redhat issued a patch about 3 hours ago, I believe Centos is still vulnerable, Ubuntu 14.10 isn't patched yet, Ubuntu 14.04 was patched about 3 hours ago.

View on HN

I'm using debian jessie (testing) i386, and I had to download bash myself (from sid) because my up-to-date system was affected but the first patch was available for sid (unstable) and wheezy (stable) and not in jessie.

So I don't know if every architecture, and version is updated with the same speed.

Jessie isn't released / stable and doesn't receive security patches until it is. It's called testing for a reason.

debian testing do receive security patches, but it is not a priority so they may not get there in a timely manner.

Yeah. I'm aware that stable and old stable need to be patched first, I was just surprised by how much time it took considering the kind of risk (and being beaten by sid, the kid whom always breaks his toys).

I did 'yum update bash' on my Centos 5.8 Linode a couple of hours ago, and it updated to 3.2-33 and is apparently no longer vulnerable, according to the one-line test I have been using:

  X="() { :;} ; echo busted" /bin/sh -c "echo stuff"

That test doesn't detect the vulnerability - needs to mention /bin/bash not /bin/sh

Well, maybe you should look at your /bin/sh

ls -l /bin/sh

lrwxrwxrwx 1 root root 4 Sep 24 08:07 /bin/sh -> bash

I think /bin/sh is /bin/bash on CentOS and RedHat, but Debian, Ubuntu and probably other distros use dash as /bin/sh instead which was never vulnerable.

CentOS released a patched bash package around 2AM GMT, something like an hour after RedHat.

Looks like 14.10 is patched now

Reply on news.ycombinator.com