<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'><font style="" color="#000000" face="Tahoma,sans-serif">We are not saying there is not vulnerability we are saying this will not happen in the situations that would occur with the BBB running Allstar. The whole scenario is way overblown like many things are by our media today. If it scares you then turn off your BBB and wait for 1.2 and also lock your doors because you might be beheaded any day! <br><br>Lets not get into a big discussion here like there has been on many other lists about this. The bottom line is it is fixed on the upcoming version and it is not a problem now.<br id="FontBreak"></font><br><b><font style="font-size:16pt;" size="4">73 Doug</font><font style="font-size:16pt;" size="4"><br></font><font style="font-size:16pt;" size="4">WA3DSP</font><font style="font-size:16pt;" size="4"><br></font><font style="font-size:16pt;" size="4">http://www.crompton.com/hamradio</font></b><font style="font-size:16pt;" size="4"><br></font><br><br><div>> Date: Sun, 28 Sep 2014 08:58:28 -0400<br>> From: kp4tr.ramon@gmail.com<br>> To: arm-allstar@hamvoip.org<br>> Subject: Re: [arm-allstar] bash patch<br>> <br>> Hello,<br>> <br>> I'm not sure why you say there is no security concerns with the old <br>> version of bash. There is, and anyone who can try it out can test <br>> themselves.<br>> <br>> The patch for Archlinux to patch this vulnerability is simple for the <br>> BBB 1.1 of Archlinux:<br>> <br>> 1. To test vulnerability, copy and paste this:<br>> env x='() { :;}; echo vulnerable' bash -c "echo If you see the word <br>> vulnerability above, you are"<br>> <br>> 2. To patch it , just update bash:<br>> pacman -S bash<br>> <br>> 3. Run step 1, again, and you won't have vulnerability<br>> <br>> <br>> <br>> On 9/28/2014 2:04 AM, David McGough wrote:<br>> > Hi Mark,<br>> ><br>> > We've already got bash updated in the upcoming 1.2 release. But, for those<br>> > running a "stock" 1.1, there are NO current security concerns with the old<br>> > version of bash. By that, I mean there is no way to use bash to exploit<br>> > the system.<br>> ><br>> > The 1.2 release fixes s long list of issues that were present in 1.1. So,<br>> > keep an eye out for this update!<br>> ><br>> ><br>> > 73, David KB4FXC<br>> ><br>> ><br>> > On Sun, 28 Sep 2014, Mark Herson, N2MH wrote:<br>> ><br>> >> Hello to the group!<br>> >><br>> >> This past week, Dave Cameron, VE7LTD, sent to the IRLP group information<br>> >> about a problem with bash along with various fixes to this problem<br>> >> depending on distro. Will bash be fixed in the new release of AllStar BBB<br>> >> code?<br>> >><br>> >> 73, Mark, N2MH<br>> >><br>> >><br>> >> _______________________________________________<br>> >><br>> >> arm-allstar mailing list<br>> >> arm-allstar@hamvoip.org<br>> >> http://lists.hamvoip.org/cgi-bin/mailman/listinfo/arm-allstar<br>> >><br>> >> Visit the BBB web page - http://www.crompton.com/hamradio/BeagleBoneBlackAllstar/<br>> >><br>> > _______________________________________________<br>> ><br>> > arm-allstar mailing list<br>> > arm-allstar@hamvoip.org<br>> > http://lists.hamvoip.org/cgi-bin/mailman/listinfo/arm-allstar<br>> ><br>> > Visit the BBB web page - http://www.crompton.com/hamradio/BeagleBoneBlackAllstar/<br>> ><br>> <br>> _______________________________________________<br>> <br>> arm-allstar mailing list<br>> arm-allstar@hamvoip.org<br>> http://lists.hamvoip.org/cgi-bin/mailman/listinfo/arm-allstar<br>> <br>> Visit the BBB web page - http://www.crompton.com/hamradio/BeagleBoneBlackAllstar/<br>> <br></div> </div></body>
</html>