Re: Bash-4.3 Official Patch 25 Bug 896776 - (CVE-2014-6271)

[Ralf Naegele]

Hello Eduardo,

I haven't installed the patched bash yet. I called it in the source 
directory after compiling, it with ./bash so I think this should start the 
patched bash. 

Regards,
Ralf



On Thu, 25 Sep 2014, Eduardo A. Bustamante López wrote:

> Date: Thu, 25 Sep 2014 13:50:00 -0700
> From: Eduardo A. Bustamante López <dualbus@gmail.com>
> To: ralf.naegele@she.net
> Cc: bug-bash@gnu.org
> Subject: Re: Bash-4.3 Official Patch 25 Bug 896776 - (CVE-2014-6271)
> 
> On Thu, Sep 25, 2014 at 05:33:38PM +0200, ralf.naegele@she.net wrote:
> > Hello,
> > 
> > I've downloaded the source for bash 4.3 and all patches, patched the source 
> > to Patch 25. 
> > But according some description I've found (http://heise.de/-2403305 sorry, 
> > only in German
> > available), you can test with the command
> > 
> > env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
>
> Did you install the patched bash properly? If you forgot to install
> it, calling 'bash' will launch the still vulnerable version.
>