I'm using Natty 11.04, which is EOL (and I have updated /etc/apt/sources.list to use old-releases.ubuntu.com), so I have to build from source. I wanted to build a .deb, so at least the package manage is "aware" the bash version is not the default one. I am not 100% succesful - however, the package is registered as "newer" and the bash
binary ends up fixed, so here is what I did:
apt-get source bash
wget https://gist.githubusercontent.com/drj11/e85ca2d7503f28ebfde8/raw/31bd53ed2e47b220d3c728f5440758e0f76769de/gistfile1.c -O bash_CVE-2014-6271.patch
wget https://gist.githubusercontent.com/drj11/239e04c686f0886253fa/raw/046e697da6d4491c3b733b0207811c55ceb9d927/gistfile1.c -O bash_CVE-2014-6271_plus.patch
cd bash-4.2/
Now, in the (sub)directory bash-4.2/
, there is: a file bash-4.2.tar.xz
, which needs to be unpacked to get to the bash
source; and a subdirectory called debian
.
I made the following changes to avoid dependencies on texlive
: in bash-4.2/debian/control
:
Source: bash
...
Build-Depends: autoconf, autotools-dev, patch, bison, libncurses5-dev,
# texinfo, debhelper (>= 5), texi2html, locales, gettext, sharutils, time, xz-ut
ils
debhelper (>= 5), locales, gettext, sharutils, time, xz-utils
# Build-Depends-Indep: texlive-latex-base, ghostscript
Build-Depends-Indep: ghostscript
... and in bash-4.2/debian/rules
:
binary-doc: bash-install #bash-doc-build
dh_testdir
dh_testroot
mkdir -p $(d_doc)/usr/share/doc/$(p)
dh_installdocs -p$(p_doc)
ifeq ($(with_gfdl),yes)
#cp -p build-bash/doc/bashref.pdf $(d_doc)/usr/share/doc/$(p)/.
#dh_link -p$(p_doc) \
# /usr/share/doc/$(p)/bashref.pdf /usr/share/doc/$(p_doc)/bashref.pdf
else
rm -f $(d_doc)/usr/share/doc-base/bashref
endif
rm -f $(d_doc)/usr/share/info/dir*
#cp -p build-bash/doc/bash.html build-bash/doc/bash.pdf \
# $(d_doc)/usr/share/doc/$(p)/
#dh_link -p$(p_doc) \
# /usr/share/doc/$(p)/bash.html /usr/share/doc/$(p_doc)/bash.html \
# /usr/share/doc/$(p)/bash.pdf /usr/share/doc/$(p_doc)/bash.pdf
dh_installchangelogs -p$(p_doc) bash/CWRU/changelog
...
To change the version, in this bash-4.2/
directory, do:
bash-4.2$ dch --local patchCVE
... and fill in the notes in the changelog when asked. This will ensure that the .deb (and related metadata) is called (in my case) bash_4.2-0ubuntu3patchCVE1_i386.deb
.
Then you can try building with dpkg-buildpackage -us -uc
or debuild
command. Note - either of these will re-unpack the source from the zip - thus overriding any patches you may have had! Still, run one of these once so the source is unpacked and built (note debuild
may still fail in the end due to texlive, but it should unpack and build the source).
Then, apply the patches; note you should use -p1
here, because currently you're in the bash-4.2/
directory:
bash-4.2$ patch -p1 < ../bash_CVE-2014-6271.patch
bash-4.2$ patch -p1 < ../bash_CVE-2014-6271_plus.patch
Then rebuild patched version by running:
bash-4.2$ fakeroot debian/rules build
This would rebuild the executable; to test it:
bash-4.2$ env VAR='() { :;}; echo Bash is vulnerable!' ./build-bash/bash -c "echo Bash Test"
To build the .deb files, run:
bash-4.2$ fakeroot debian/rules binary
This will save the .deb files in the parent directory; to list their contents:
bash-4.2$ dpkg -c ../bash_4.2-0ubuntu3patchCVE1_i386.deb
To install the .deb:
bash-4.2$ sudo dpkg -i ../bash_4.2-0ubuntu3patchCVE1_i386.deb
However, for some reason, this .deb contains an unpatched binary (?!), so I had to additionally do:
bash-4.2$ sudo cp bash-4.2/build-bash/bash /bin/
... and after that, the test started passing correctly for me:
$ env VAR='() { :;}; echo Bash is!' bash -c "echo Bash Test"
bash: warning: VAR: ignoring function definition attempt
bash: error importing function definition for `VAR'
Bash Test