On Thu, 2014-09-25 at 09:16 +0000, Werf, C.G. van der (Carel) wrote:
> Yesterday a lot of yum-updates ran to update to the latest bash-versions.
>
> Though my /bin/bash was changed last night, and yum.log shows 3.2.33 should
> have installed,
> # /bin/bash --version still shows 3.2.25
>
> Ofcourse, also # strings /bin/bash shows old version number.
>
> Is this a policy NOT to change version-numbers ?
It's worth pointing out that there has just been a serious (and possibly
remote!) bash vulnerability which this fixes.
A test is:
env X="() { :;} ; echo vulnerable" /bin/bash -c "echo completed"
My systems were echoing "vulnerable" before the fix but not after.
John
