<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>Sorry to post again but I guess this post was started by me so whatever:<br><br>Ubuntu and other Debian-derived systems that use Dash exclusively are
not at risk – Dash isn't vulnerable, but busted versions of Bash may
well be present on the systems anyway. It's essential you check the
shell interpreters you're using, and any Bash packages you have
installed, and patch if necessary.<br><br>^above provided by --> <a href="http://www.theregister.co.uk/2014/09/24/bash_shell_vuln/" target="_blank">http://www.theregister.co.uk/2014/09/24/bash_shell_vuln/</a><br><br>Maybe I should move onto something else I could spend a week just reading on this topic. For a little person such as myself is that even time well spent?<br><br>Just a thought.<br><br>Thanks,<br><br><div><hr id="stopSpelling">From: pj.world@hotmail.com<br>To: tclug-list@mn-linux.org<br>Date: Fri, 9 Jan 2015 16:47:28 -0600<br>Subject: Re: [tclug-list] Patch Bash ShellShock exploit with MKSH?<br><br>
<style><!--
.ExternalClass .ecxhmmessage P {
padding:0px;
}
.ExternalClass body.ecxhmmessage {
font-size:12pt;
font-family:Calibri;
}
--></style>
<div dir="ltr">Yeah I appreciate your advice on doing some vulnerability testing on my computer also. I have been reading mainly this article I found off the Mint forums. --> <a href="http://www.troyhunt.com/2014/09/everything-you-need-to-know-about.html" target="_blank">http://www.troyhunt.com/2014/09/everything-you-need-to-know-about.html</a> <br><br>Granted it's an older article but I could understand most of it quite well. Down by the reader comments they are apparently commenting on how Debian is: /bin/sh -> dash not /bin/sh -> bash<br><br>Granted there is way more to this than just that.<br><br>Thanks,<br><br><div>> Date: Fri, 9 Jan 2015 16:34:21 -0600<br>> From: chapinjeff@gmail.com<br>> To: tclug-list@mn-linux.org<br>> Subject: Re: [tclug-list] Patch Bash ShellShock exploit with MKSH?<br>> <br>> You may wish to test if your version of bash is still unpatched. It's<br>> highly likely that you don't even need to cobble together a workaround<br>> to partially protect yourself. If your version of bash is patched, you<br>> don't have to do anything at all.<br>> <br>> On Fri, Jan 9, 2015 at 4:22 PM, paul g <pj.world@hotmail.com> wrote:<br>> > Thanks for the links i've been reading for the last 4 hours. I am a very<br>> > slow reader but I believe that at least part of the 'patch' so far at least<br>> > on Mint 17 is:<br>> ><br>> > lrwxrwxrwx 1 root root 4 Dec 11 23:13 sh -> dash<br>> ><br>> > See above symlinked sh to dash now not bash.<br>> ><br>> > Thanks for responding and sending the links over.<br>> ><br>> ><br>> ><br>> >> Date: Fri, 9 Jan 2015 02:20:23 -0600<br>> >> From: chapinjeff@gmail.com<br>> >> To: tclug-list@mn-linux.org<br>> >> Subject: Re: [tclug-list] Patch Bash ShellShock exploit with MKSH?<br>> ><br>> >><br>> >> On Thu, Jan 8, 2015 at 10:44 PM, paul g <pj.world@hotmail.com> wrote:<br>> >> > 1. Can I migrate to MKSH shell on my LinuxMint17 computer quite easily?<br>> >> http://community.linuxmint.com/software/view/mksh<br>> >><br>> >> Looks like it's in the Mint repos, so installing it is fairly easy.<br>> >> Since it is related to ksh, and not bash, there will be a little bit<br>> >> of a learning curve.<br>> >><br>> >><br>> >> ><br>> >> > 2. How necessary is this to be concerned about?<br>> >><br>> >><br>> >> Not at all. Shellshock has been patched on most major modern OSes<br>> >> since October. You can check if you are still on a vulnreble version<br>> >> of bash following the directions here:<br>> >><br>> >><br>> >> http://linuxg.net/canonical-has-patched-bash-agains-the-shellshock-exploit-update-your-ubuntu-14-04-or-ubuntu-12-04-system-now/<br>> >><br>> >><br>> >> ><br>> >> > Your thoughts are appreciated.<br>> >> > Thank you,<br>> >> ><br>> >> > _______________________________________________<br>> >> > TCLUG Mailing List - Minneapolis/St. Paul, Minnesota<br>> >> > tclug-list@mn-linux.org<br>> >> > http://mailman.mn-linux.org/mailman/listinfo/tclug-list<br>> >> ><br>> >><br>> >><br>> >><br>> >> --<br>> >> Jeff Chapin<br>> >> President, CedarLug, retired<br>> >> President, UNIPC, "I'll get around to it"<br>> >> President, UNI Scuba Club<br>> >> Senator, NISG, retired<br>> >> _______________________________________________<br>> >> TCLUG Mailing List - Minneapolis/St. Paul, Minnesota<br>> >> tclug-list@mn-linux.org<br>> >> http://mailman.mn-linux.org/mailman/listinfo/tclug-list<br>> ><br>> > _______________________________________________<br>> > TCLUG Mailing List - Minneapolis/St. Paul, Minnesota<br>> > tclug-list@mn-linux.org<br>> > http://mailman.mn-linux.org/mailman/listinfo/tclug-list<br>> ><br>> <br>> <br>> <br>> -- <br>> Jeff Chapin<br>> President, CedarLug, retired<br>> President, UNIPC, "I'll get around to it"<br>> President, UNI Scuba Club<br>> Senator, NISG, retired<br>> _______________________________________________<br>> TCLUG Mailing List - Minneapolis/St. Paul, Minnesota<br>> tclug-list@mn-linux.org<br>> http://mailman.mn-linux.org/mailman/listinfo/tclug-list<br></div> </div>
<br>_______________________________________________
TCLUG Mailing List - Minneapolis/St. Paul, Minnesota
tclug-list@mn-linux.org
http://mailman.mn-linux.org/mailman/listinfo/tclug-list</div> </div></body>
</html>