How do you fix the Shellshock vulnerability on Debian 6.0 (Squeeze)?

bash shellshock-bash-bug
batflaps picture batflaps · Sep 27, 2014 · Viewed 14.5k times · Source

How do you fix the Shellshock Bash vulnerability on Debian 6.0 (Squeeze)?

Answer

batflaps picture batflaps · Sep 27, 2014

I had to add LTS repositories to update Bash which fixes the Shellshock vulnerability on Debian 6.0 (Squeeze). I hope someone else finds this useful:

First, check to see if your box is vulnerable. Cut/paste this to your command line:

env x='() { :;}; echo "WARNING: SHELLSHOCK DETECTED"' \
bash --norc -c ':' 2>/dev/null;

If you get a response like:

WARNING: SHELLSHOCK DETECTED

As I did in Squeeze, you have the vulnerability. You'll have to update your repositories to the LTS version to get the updates, by commenting out your current repository lines starting with 'deb' in your /etc/apt/sources.list file and then adding these:

deb http://http.debian.net/debian/ squeeze main contrib non-free
deb-src http://http.debian.net/debian/ squeeze main contrib non-free
deb http://security.debian.org/ squeeze/updates main contrib non-free
deb-src http://security.debian.org/ squeeze/updates main contrib non-free
deb http://http.debian.net/debian squeeze-lts main contrib non-free
deb-src http://http.debian.net/debian squeeze-lts main contrib non-free

Now you should update your local cache and install the upgraded Bash (their servers are slow now because everyone's updating, so just pull down the Bash one for bandwidth's sake):

apt-get update && apt-get install --only-upgrade bash

You can do a full system upgrade later. Now run the vulnerability check script above and you shouldn't get any text output, which means you're patched :)

Related questions

How to concatenate string variables in Bash

In PHP, strings are concatenated together as follows: $foo = "Hello"; $foo .= " World"; Here, $foo becomes "Hello World". How is this accomplished in Bash?

Read More
How can I check if a directory exists in a Bash shell script?

What command can be used to check if a directory exists or not, within a Bash shell script?

Read More
How do I tell if a regular file does not exist in Bash?

I've used the following script to see if a file exists: #!/bin/bash FILE=$1 if [ -f $FILE ]; then echo "File $FILE exists." else echo "File $FILE does not exist." fi What's the correct syntax to use if I only want …

Read More