<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>Jeff, <br><br>I did test a couple of my computers running Mint 17 here and they are patched. That's funny the word 'cobble' that reminds me of alot of fun/interesting/challenging situations. <br><br>Thanks, <br><br>paul<br><br><div>> Date: Fri, 9 Jan 2015 19:09:52 -0600<br>> From: chapinjeff@gmail.com<br>> To: tclug-list@mn-linux.org<br>> Subject: Re: [tclug-list] Patch Bash ShellShock exploit with MKSH?<br>> <br>> Paul,<br>> <br>> I would like to once again suggest that you simply test the version of<br>> bash you have installed. There is no need to worry if you are not at<br>> risk.<br>> <br>> Jeff<br>> <br>> On Fri, Jan 9, 2015 at 6:49 PM, paul g <pj.world@hotmail.com> wrote:<br>> > Sorry to post again but I guess this post was started by me so whatever:<br>> ><br>> > Ubuntu and other Debian-derived systems that use Dash exclusively are not at<br>> > risk – Dash isn't vulnerable, but busted versions of Bash may well be<br>> > present on the systems anyway. It's essential you check the shell<br>> > interpreters you're using, and any Bash packages you have installed, and<br>> > patch if necessary.<br>> ><br>> > ^above provided by --><br>> > http://www.theregister.co.uk/2014/09/24/bash_shell_vuln/<br>> ><br>> > Maybe I should move onto something else I could spend a week just reading on<br>> > this topic. For a little person such as myself is that even time well spent?<br>> ><br>> > Just a thought.<br>> ><br>> > Thanks,<br>> ><br>> > ________________________________<br>> > From: pj.world@hotmail.com<br>> > To: tclug-list@mn-linux.org<br>> > Date: Fri, 9 Jan 2015 16:47:28 -0600<br>> ><br>> > Subject: Re: [tclug-list] Patch Bash ShellShock exploit with MKSH?<br>> ><br>> > Yeah I appreciate your advice on doing some vulnerability testing on my<br>> > computer also. I have been reading mainly this article I found off the Mint<br>> > forums. --><br>> > http://www.troyhunt.com/2014/09/everything-you-need-to-know-about.html<br>> ><br>> > Granted it's an older article but I could understand most of it quite well.<br>> > Down by the reader comments they are apparently commenting on how Debian is:<br>> > /bin/sh -> dash not /bin/sh -> bash<br>> ><br>> > Granted there is way more to this than just that.<br>> ><br>> > Thanks,<br>> ><br>> >> Date: Fri, 9 Jan 2015 16:34:21 -0600<br>> >> From: chapinjeff@gmail.com<br>> >> To: tclug-list@mn-linux.org<br>> >> Subject: Re: [tclug-list] Patch Bash ShellShock exploit with MKSH?<br>> >><br>> >> You may wish to test if your version of bash is still unpatched. It's<br>> >> highly likely that you don't even need to cobble together a workaround<br>> >> to partially protect yourself. If your version of bash is patched, you<br>> >> don't have to do anything at all.<br>> >><br>> >> On Fri, Jan 9, 2015 at 4:22 PM, paul g <pj.world@hotmail.com> wrote:<br>> >> > Thanks for the links i've been reading for the last 4 hours. I am a very<br>> >> > slow reader but I believe that at least part of the 'patch' so far at<br>> >> > least<br>> >> > on Mint 17 is:<br>> >> ><br>> >> > lrwxrwxrwx 1 root root 4 Dec 11 23:13 sh -> dash<br>> >> ><br>> >> > See above symlinked sh to dash now not bash.<br>> >> ><br>> >> > Thanks for responding and sending the links over.<br>> >> ><br>> >> ><br>> >> ><br>> >> >> Date: Fri, 9 Jan 2015 02:20:23 -0600<br>> >> >> From: chapinjeff@gmail.com<br>> >> >> To: tclug-list@mn-linux.org<br>> >> >> Subject: Re: [tclug-list] Patch Bash ShellShock exploit with MKSH?<br>> >> ><br>> >> >><br>> >> >> On Thu, Jan 8, 2015 at 10:44 PM, paul g <pj.world@hotmail.com> wrote:<br>> >> >> > 1. Can I migrate to MKSH shell on my LinuxMint17 computer quite<br>> >> >> > easily?<br>> >> >> http://community.linuxmint.com/software/view/mksh<br>> >> >><br>> >> >> Looks like it's in the Mint repos, so installing it is fairly easy.<br>> >> >> Since it is related to ksh, and not bash, there will be a little bit<br>> >> >> of a learning curve.<br>> >> >><br>> >> >><br>> >> >> ><br>> >> >> > 2. How necessary is this to be concerned about?<br>> >> >><br>> >> >><br>> >> >> Not at all. Shellshock has been patched on most major modern OSes<br>> >> >> since October. You can check if you are still on a vulnreble version<br>> >> >> of bash following the directions here:<br>> >> >><br>> >> >><br>> >> >><br>> >> >> http://linuxg.net/canonical-has-patched-bash-agains-the-shellshock-exploit-update-your-ubuntu-14-04-or-ubuntu-12-04-system-now/<br>> >> >><br>> >> >><br>> >> >> ><br>> >> >> > Your thoughts are appreciated.<br>> >> >> > Thank you,<br>> >> >> ><br>> >> >> > _______________________________________________<br>> >> >> > TCLUG Mailing List - Minneapolis/St. Paul, Minnesota<br>> >> >> > tclug-list@mn-linux.org<br>> >> >> > http://mailman.mn-linux.org/mailman/listinfo/tclug-list<br>> >> >> ><br>> >> >><br>> >> >><br>> >> >><br>> >> >> --<br>> >> >> Jeff Chapin<br>> >> >> President, CedarLug, retired<br>> >> >> President, UNIPC, "I'll get around to it"<br>> >> >> President, UNI Scuba Club<br>> >> >> Senator, NISG, retired<br>> >> >> _______________________________________________<br>> >> >> TCLUG Mailing List - Minneapolis/St. Paul, Minnesota<br>> >> >> tclug-list@mn-linux.org<br>> >> >> http://mailman.mn-linux.org/mailman/listinfo/tclug-list<br>> >> ><br>> >> > _______________________________________________<br>> >> > TCLUG Mailing List - Minneapolis/St. Paul, Minnesota<br>> >> > tclug-list@mn-linux.org<br>> >> > http://mailman.mn-linux.org/mailman/listinfo/tclug-list<br>> >> ><br>> >><br>> >><br>> >><br>> >> --<br>> >> Jeff Chapin<br>> >> President, CedarLug, retired<br>> >> President, UNIPC, "I'll get around to it"<br>> >> President, UNI Scuba Club<br>> >> Senator, NISG, retired<br>> >> _______________________________________________<br>> >> TCLUG Mailing List - Minneapolis/St. Paul, Minnesota<br>> >> tclug-list@mn-linux.org<br>> >> http://mailman.mn-linux.org/mailman/listinfo/tclug-list<br>> ><br>> > _______________________________________________ TCLUG Mailing List -<br>> > Minneapolis/St. Paul, Minnesota tclug-list@mn-linux.org<br>> > http://mailman.mn-linux.org/mailman/listinfo/tclug-list<br>> ><br>> > _______________________________________________<br>> > TCLUG Mailing List - Minneapolis/St. Paul, Minnesota<br>> > tclug-list@mn-linux.org<br>> > http://mailman.mn-linux.org/mailman/listinfo/tclug-list<br>> ><br>> <br>> <br>> <br>> -- <br>> Jeff Chapin<br>> President, CedarLug, retired<br>> President, UNIPC, "I'll get around to it"<br>> President, UNI Scuba Club<br>> Senator, NISG, retired<br>> _______________________________________________<br>> TCLUG Mailing List - Minneapolis/St. Paul, Minnesota<br>> tclug-list@mn-linux.org<br>> http://mailman.mn-linux.org/mailman/listinfo/tclug-list<br></div> </div></body>
</html>