On Friday 26 September 2014 14:05:01 Michael D. Setzer II wrote: > I download the > ftp://ftp.gnu.org/gnu/bash/bash-4.3.tar.gz > and the patches in > ftp://ftp.gnu.org/gnu/bash/bash-4.3-patches/ > > Installed the 25 patches and then build the code. > Running the test on that version of bash passes the test. > > Don't know if there would be any issues with then replacing the older bash > on a system with the newly build one, but that didn't take much time to > build. Tried this and it appears that this version of BASH is still vulnerable [root@test bash-4.3]# ./bash [root@test bash-4.3]# echo $BASH_VERSION 4.3.25(1)-release [root@test bash-4.3]# env x='() { :;}; echo vulnerable' bash -c "echo this is a test" vulnerable this is a test [root@test bash-4.3]# -- users mailing list users@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe or change subscription options: https://admin.fedoraproject.org/mailman/listinfo/users Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines Have a question? Ask away: http://ask.fedoraproject.org
