2

I've got unattended-upgrades on ubuntu-12.04.5 set to automatically install security updates. Is that going to take care of shellshock (cve-2014-6271)?

Improve this question
2
  • 2
    I can't answer that directly which is why this is a comment, but I will say that if your server is in a position where its vulnerabilities are likely to be exposed to attackers then you should verify that the patch is installed and schedule an emergency maintenance window to install it by hand urgently if it is not, rather than relying on automatic maintenance schedules either way.
    – Rob Moir
    Sep 26, 2014 at 6:57
  • Thanks RobM. I've already installed, as far as I can tell, the first patch, but from what I've read it's not a complete fix. The paranoid engineer in me wants something automatic that will more or less guarantee this gets patched whether I do or not (even though I fully plan on being on top of this). Also, I'm new to unattended-upgrades, and want to wrap my head around it's degree of reliability / universality.
    – jpadvo
    Sep 26, 2014 at 7:10

1 Answer 1

Reset to default
1

If you run this:

env x='() { :;}; echo vulnerable' bash -c "echo this is a test"

It should not say "vulnerable". ( See also https://superuser.com/a/816780 )

I'm not sure how "unnattended upgrades" works. I just tried setting it up on my server and was wondering the same thing. So I ran this:

sudo unattended-upgrade

which seemed to run too quickly to be updating anything. I ran this:

sudo dpkg-reconfigure -plow unattended-upgrades

to set something up. Again it didn't seem to be running updates.

...and sure enough, the above test still said "vulnerable". For me, I then just did a full update of all packages ( apt-get update && apt-get -y upgrade ) and... no longer vulnerable.

Maybe this means the answer is "no" ...which begs the question why not?!

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .