Michael Tremer

IPFire 2.15 - Core Update 83 is available for testing
by Michael Tremer, September 27, 2014

Hello,

this is the testing announcement for IPFire 2.15 Core Update 83 which mainly provides a fix for several security issues in the GNU bash package also known as “ShellShock” and filed under CVE-2014-6271 and CVE-2014-7169.

ShellShock

It was possible to inject shell commands that were executed from the shell environment. For example:

env x='() { :;}; echo vulnerable' bash -c "echo test"

IPFire uses CGI scripts for its web user interface. Therefore it was possible for authenticated users to execute shell commands with non-root privileges and of course users that had access to the shell on command line.

Further information about this error can be found on:

Misc


We are looking forward to receive lots of feedback from you guys. We are going to release this update to all users as soon as possible, so please help us doing that!


Posted: September 27, 2014 • 732 views