I updated bash as soon as both patches were available, and using the test script at https://shellshocker.net, I am showing fixed on all vulnerabilities except for segfault
.
OS:
cat /etc/*release*
CentOS release 6.5 (Final)
Installed bash version:
yum info bash
Name : bash
Arch : x86_64
Version : 4.1.2
Release : 15.el6_5.2
Here's the segfault portion of the test script:
# CVE-2014-6277
CVE20146277=$((bash -c "f() { x() { _;}; x() { _;} <<a; }" 2>/dev/null || echo vulnerable) | grep 'vulnerable' | wc -l)
echo -n "CVE-2014-6277 (segfault): "
if [ $CVE20146277 -gt 0 ]; then
echo -e "\033[91mVULNERABLE\033[39m"
EXITCODE=$((EXITCODE+2))
else
echo -e "\033[92mnot vulnerable\033[39m"
fi
I'm not showing any more updates to bash in the repositories (I've actually checked twice a day since last week).
Is there another way of patching the segfault vulnerability (without building from source)?