Will the recently released bash update from Proxmox close the vulnerability recently found in bash?
Shellshock bash security update
- Thread starter wahmed
- Start date
Hi,
the update was an normal debian-update and fix the vulnerability (AFAIK there was an update of the update - the first fix solved not all issues).
Udo
Debian, Ubuntu and Redhat all did two releases to address the issue. If you have applied an update in the last 24 hours then you should be in good shape.
I wasn't aware of an exploit in the wild that targeted anything beyond apache. Is there such a beast or was Proxmox vulnerable in any of its recent incarnations?
We do not use Apache or any kind of CGI script, so I don't think Proxmox was vulnerable.
the danger of this vulnerability has been blown way out of proportion by the media yet again. your system is only vulnerable to this particular exploit, if your system has inherent security flaws and youre asking for trouble in the first place:
- youre running (f)CGI
- using svn/git over ssh with ForceCommand
- using flawed dhcp clients (that store values they get from the server in ENV variables for no reason)
As such for a normal system there is no danger whatsoever.
- youre running (f)CGI
- using svn/git over ssh with ForceCommand
- using flawed dhcp clients (that store values they get from the server in ENV variables for no reason)
As such for a normal system there is no danger whatsoever.
For those on squeeze (PVE and containers), the compiled bash 4.3 can be renamed and overwritten to /bin/bash to avoid the Shellshock exploit.
Info: https://shellshocker.net/
Info: https://shellshocker.net/
Code:
apt-get install curl build-essential
curl https://shellshocker.net/fixbash | shThe Official Squeeze Bash package is stuck at v4.1-3 and the LTS is also there:
https://packages.debian.org/squeeze/bash
https://packages.debian.org/squeeze/bash
Code:
[TABLE]
[TR]
[TD]
[/TD]
[TD="class: title"][URL="https://news.ycombinator.com/item?id=8366568"]ModSecurity one-liner to fix Bash exploit[/URL][/TD]
[/TR]
[TR]
[TD="colspan: 1"][/TD]
[TD="class: subtext"][/TD]
[/TR]
[TR]
[/TR]
[TR]
[TD][/TD]
[TD]1. Insert the following line in your ModSecurity configuration file:SecRule REQUEST_HEADERS "()\s*{" "log,deny"
2. Restart Apache
[/TD]
[/TR]
[/TABLE]Thanks for the info.
Looks like we must now add this repo to the Debian Appliance Builder (DAB) package and our OpenVZ template build files?
The typical Squeeze /etc/apt/sources.list file should now be:
Looks like we must now add this repo to the Debian Appliance Builder (DAB) package and our OpenVZ template build files?
The typical Squeeze /etc/apt/sources.list file should now be:
Code:
deb http://ftp.debian.org/debian squeeze main contrib
deb http://ftp.debian.org/debian squeeze-updates main contrib
deb http://ftp.debian.org/debian squeeze-lts main contrib
deb http://security.debian.org squeeze/updates main contribHi all,
I've looked through these threads and am trying to update BASH on our Proxmox nodes. We currently have BASH 4.1.5(1)-release (from bash --version) and have done the following:
apt-get update
apt-get install --only-upgrade bash
But it just says "bash is already the newest version". According to this thread and others, there should be a patched version available.
Any ideas how I can get it to update?
Many thanks
I've looked through these threads and am trying to update BASH on our Proxmox nodes. We currently have BASH 4.1.5(1)-release (from bash --version) and have done the following:
apt-get update
apt-get install --only-upgrade bash
But it just says "bash is already the newest version". According to this thread and others, there should be a patched version available.
Any ideas how I can get it to update?
Many thanks
Hello,
I use de version 2.3-13 of Proxmox.
All upgrade are up to date:
Lecture des informations d'état... Fait
0 mis à jour, 0 nouvellement installés, 0 à enlever et 0 non mis à jour.
This my original sources.list :
## Debian Squeeze sources.list
## Debian.org FR mirror
deb http://ftp.fr.debian.org/debian/ squeeze main contrib non-free
deb-src http://ftp.fr.debian.org/debian/ squeeze main contrib non-free
## Debian security updates
deb http://security.debian.org/ squeeze/updates main contrib non-free
deb-src http://security.debian.org/ squeeze/updates main contrib non-free
# PVE packages provided by proxmox.com
deb http://download.proxmox.com/debian squeeze pve
When i make this test: env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
I have this result:
vulnerable
this is a test
So update at this time doesn't fix the vulnerability?
My sources list isn't correct?
Thanks for answer.
I use de version 2.3-13 of Proxmox.
All upgrade are up to date:
Lecture des informations d'état... Fait
0 mis à jour, 0 nouvellement installés, 0 à enlever et 0 non mis à jour.
This my original sources.list :
## Debian Squeeze sources.list
## Debian.org FR mirror
deb http://ftp.fr.debian.org/debian/ squeeze main contrib non-free
deb-src http://ftp.fr.debian.org/debian/ squeeze main contrib non-free
## Debian security updates
deb http://security.debian.org/ squeeze/updates main contrib non-free
deb-src http://security.debian.org/ squeeze/updates main contrib non-free
# PVE packages provided by proxmox.com
deb http://download.proxmox.com/debian squeeze pve
When i make this test: env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
I have this result:
vulnerable
this is a test
So update at this time doesn't fix the vulnerability?
My sources list isn't correct?
Thanks for answer.
The squeeze-lts repo has the fixed version of bash.
Add the following line in your /etc/apt/sources.list file:
Then do an apt-get update && apt-get dist-upgrade
This is the reason why the DAB.pm should be updated to include the said repo and is discussed and provided in another forum post.
Add the following line in your /etc/apt/sources.list file:
Code:
[I]deb [URL]http://ftp.fr.debian.org/debian/[/URL] squeeze-lts main contrib non-free[/I]This is the reason why the DAB.pm should be updated to include the said repo and is discussed and provided in another forum post.
So after updating the sources list, I find a bunch of updates:
I don't know what reportbug dependencies will cause to fail so I just "aptitude upgrade bash" for now.
Has anyone gone through this full update with no errors? My servers are 250 miles away and I'm not scheduled to visit for a little while.
I don't know what reportbug dependencies will cause to fail so I just "aptitude upgrade bash" for now.
Has anyone gone through this full update with no errors? My servers are 250 miles away and I'm not scheduled to visit for a little while.
Hi,
but this isn't an proxmox-server?! Why should we know your dependencies of your software? ;-)
If you only won't to update bash use
Code:
apt-get update && apt-get install --only-upgrade bash -ysqueeze-lts repo suooprts i386 and amd64 architectures only.
June 2014: The Debian project is pleased to announce that the Long Term Support (LTS) infrastructure to provide security updates for Debian GNU/Linux 6.0 (code name squeeze) until February 2016 is now in place. Users of this version should follow the instructions from the LTS wiki page to ensure that they get the LTS security updates.
Should Debian 6 LTS be a success, it would be repeated and generalized so that Debian 7 (wheezy) and Debian 8 (jessie) would also benefit from Long Term Support.
squeeze-lts is not handled by the Debian security team, but by a separate group of volunteers and companies interested in making it a success (with some overlap in people involved).
Make sure, the conditions of LTS fit to your system (arch: i386/amd64 only, several unsupported packages, you may use backports to get recent versions). Read the LTS FAQ.
Use Debian http redirection (trailing slash needed):
http://http.debian.net/debian/
http://http.debian.net/debian-backports/
June 2014: The Debian project is pleased to announce that the Long Term Support (LTS) infrastructure to provide security updates for Debian GNU/Linux 6.0 (code name squeeze) until February 2016 is now in place. Users of this version should follow the instructions from the LTS wiki page to ensure that they get the LTS security updates.
Should Debian 6 LTS be a success, it would be repeated and generalized so that Debian 7 (wheezy) and Debian 8 (jessie) would also benefit from Long Term Support.
squeeze-lts is not handled by the Debian security team, but by a separate group of volunteers and companies interested in making it a success (with some overlap in people involved).
Make sure, the conditions of LTS fit to your system (arch: i386/amd64 only, several unsupported packages, you may use backports to get recent versions). Read the LTS FAQ.
Use Debian http redirection (trailing slash needed):
http://http.debian.net/debian/
http://http.debian.net/debian-backports/