I have a Ubuntu [EDIT] 12.04.4 LTS server that is vulnerable to the recent bash remote executable exploit. Ubuntu says they have released a patch here. I have run a

sudo apt-get update && sudo apt-get upgrade

but when I run

env x='() { :;}; echo vulnerable'  bash -c "echo this is a test"

I still get

this is a test

I have also tried rebooting with no difference. Is there a problem with the test or is there another step for patching?


1) updated the server to 14.04.1
2) reconfigured sources.list for default trusty mirrors including security.ubuntu.com, pulled updates
3) rebooted

Compared against a fresh 14.04.1 install (with security updates downloaded on install) which passes testing.

However on original server test fails.

  • Also echo ${BASH_VERSINFO[2]} returns 25 (the patched version). Is the patch failing the test? – essefbx Sep 24 '14 at 20:45
  • 1
    Please add the output of apt-cache policy bash to your question. – Florian Diesch Sep 24 '14 at 20:48
  • my network has privately hosted mirrors - would that be the issue? – essefbx Sep 24 '14 at 20:55
  • but essentially - Installed: 4.2-2ubuntu2.1 Candidate: 4.2-2ubuntu2.1 Version table: *** 4.2-2ubuntu2.1 0 – essefbx Sep 24 '14 at 20:59
  • 1
    Had to use sudo apt-get update && sudo apt-get install -y bash for the patch to be applied to 12.04 myself. The official method for updating does not seem to work. That's pretty bad if you ask me. – Maarten Bodewes Sep 25 '14 at 23:15

You must upgrade to 12.04.5, 12.04.4 went EOL aug 8th, try apt-get dist-upgrade


Confirmed patch on 14.04:

$ env x='() { :;}; echo vulnerable'  bash -c "echo this is a test"
bash: warning: x: ignoring function definition attempt
bash: error importing function definition for `x'
this is a test

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.