Ubuntu – Recommended Way to Patch Shellshock Bash Bug on Unsupported Server

bashdebianUbuntuupgrade

I maintain an out-of-support Ubuntu 12.10 (Quantal Quetzal) server (don't ask me why, please), and we need to patch the Shellshock Bash security bug. As upgrades are not available anymore, what is the recommended way to patch Bash?

I found this answer (it recommends retrieving packages from Debian and to not install binaries packages, but install packages from source). That seems OK to me, but what is some other advice?

Best Answer

This write up was helpful and worked for the few instances of Ubuntu 12.10 (Quantal) I still have to support.

Fix Bash Exploit On New and Old Releases of Ubuntu

In Summary, the steps are:

  1. Get the codename of your current release (e.g. quantal) and store it in a variable:

    lsb_release -a
DISTRIB_CODENAME=quantal

  2. Change source to trusty in /etc/apt/sources.list. For example,

    sudo sed -i "s/$DISTRIB_CODENAME/trusty/g" /etc/apt/sources.list

  3. Update and upgrade bash

    sudo apt-get update

sudo apt-get install --only-upgrade bash

  4. Verify latest version fails the following test (i.e. you should not see "busted")

    env X="() { :;} ; echo busted" `which bash` -c "echo completed"

  5. Revert /etc/apt/sources.list to use current codename. For example,

    sudo sed -i "s/trusty/$DISTRIB_CODENAME/g" /etc/apt/sources.list
Related Topic