bash升级后还是显示vulnerable

林纳克斯

[root@APP-1 ~]# cat /etc/issue
Red Hat Enterprise Linux Server release 6.5 (Santiago)
Kernel \r on an \m

[root@APP-1 ~]#
[root@APP-1 ~]# uname -a
Linux APP-1 2.6.32-431.el6.x86_64 #1 SMP Sun Nov 10 22:19:54 EST 2013 x86_64 x86_64 x86_64 GNU/Linux
[root@APP-1 ~]#

升级bash后测试：
[root@APP-1 ~]# env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
vulnerable
this is a test
[root@APP-1 ~]#

[root@APP-1 ~]# rpm -ivhU --force bash-4.1.2-15.el6_5.2.x86_64.rpm
warning: bash-4.1.2-15.el6_5.2.x86_64.rpm: Header V3 RSA/SHA1 Signature, key ID c105b9de: NOKEY
Preparing...                ########################################### [100%]
   1:bash                   ########################################### [100%]
[root@APP-1 ~]#
再测试，还是那样。

[root@APP-1 ~]# bash --version
GNU bash, version 4.1.2(1)-release (x86_64-redhat-linux-gnu)
Copyright (C) 2009 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>

This is free software; you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
[root@APP-1 ~]#

谢谢！

cate1019

建议你直接用yum update bash
我在Cents 5.0上测试成功。

cattiger

关键是yum的更新服务器上有不有适合您对应操作系统的更新

segafans_cu

rpm -Uvh bash-XXX.rpm

rpm -q bash

林纳克斯

[root@APP-1 ~]# rpm -Uvh bash-4.1.2-15.el6_5.2.x86_64.rpm
warning: bash-4.1.2-15.el6_5.2.x86_64.rpm: Header V3 RSA/SHA1 Signature, key ID c105b9de: NOKEY
Preparing...                ########################################### [100%]
        package bash-4.1.2-15.el6_5.2.x86_64 is already installed
[root@APP-1 ~]#
[root@APP-1 ~]# rpm -q bash
bash-4.1.2-15.el6_5.2.x86_64
[root@APP-1 ~]#

cate1019

回复 5# 林纳克斯


换个源试试。。

action08

shell@ubuntu:~$ bash --version
GNU bash, version 4.2.25(1)-release (x86_64-pc-linux-gnu)
Copyright (C) 2011 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>

This is free software; you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
shell@ubuntu:~$
shell@ubuntu:~$
shell@ubuntu:~$


这个是ubu1204最新的

action08

shell@ubuntu:~$ bash --version
GNU bash, version 4.2.25(1)-release (x86_64-pc-linux-gnu)
Copyright (C) 2011 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>

This is free software; you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
shell@ubuntu:~$
shell@ubuntu:~$
shell@ubuntu:~$ env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
this is a test
shell@ubuntu:~$
shell@ubuntu:~$

segafans_cu

你这个包是从哪里下载的？
你试试我发布的那个包。
我发布的那个包，400多台redhat都打了，均正常。