Shellshock protection in Rackspace Ubuntu

Question

I am trying to update my Ubuntu 13.10 servers in Rackspace to avoid Shellshock bug, but it is not working. Here is what I am doing:

$ sudo apt-get update && sudo apt-get install --only-upgrade bash

it says:

bash is already the newest version.
0 upgraded, 0 newly installed, 0 to remove and 35 not upgraded.

$ env VAR='() { :;}; echo Bash is vulnerable!' bash -c "echo Bash Test"
Bash is vulnerable!
Bash Test

What I am doing wrong?

What version of Ubuntu are you on? What apt repos are you using? — EEAA, Sep 27 '14 at 21:49
I'm also seeing this same issue on a Ubuntu digital ocean droplet... — Chris Foster, Sep 27 '14 at 23:07
Ah, it turns out that the machine I'm trying to update is on an old version of Ubuntu. Please see my [answer](http://serverfault.com/a/631819/46432) — Chris Foster, Sep 27 '14 at 23:14

score 1 · Accepted Answer · answered Sep 27 '14 at 23:12

1

Please make sure you are on a supported version of Ubuntu!

Anything that is EOL does not receive the bash update, as far as I'm aware. If you are on Ubuntu 14.04, you should receive the update.

Anything like 13.10, however, does not from what I can tell. Please upgrade Ubuntu and then update try updating bash, that will hopefully help!

answered Sep 27 '14 at 23:12

Chris Foster

176
1
4

Do I need to Update the whole distribution? I would want to only update the bash security hole – Daniel Cukier Sep 28 '14 at 16:09
@DanielCukier - Yes, if you are using an EOL Ubuntu version I don't believe there is any way to get security fixes. – Chris Foster Sep 29 '14 at 00:56

Shellshock protection in Rackspace Ubuntu

1 Answers1