Patch old Fedora 8 server for Shellshock Bash bug

I had an old Fedora 8 server running legacy code that I needed to patch for the Shellshock Bash bug. I proved that bash was vunerable by running this command:

env X="() { :; } ; echo busted" /bin/bash -c "echo stuff"

I saw the word “busted” in the output, meaning I needed to upgrade bash.

While newer systems have a patch available, I was not able to find one for Fedora 8, so I patched it manually by building a patched version of bash 4.2. Here is what I did:

yum install bison # in case yacc is not installed

cd /usr/src

curl -O http://ftp.gnu.org/gnu/bash/bash-4.2.tar.gz
tar xvfz bash-4.2.tar.gz
cd bash-4.2

for i in $(seq -f "%03g" 0 48); do curl https://ftp.gnu.org/pub/gnu/bash/bash-4.2-patches/bash42-$i | patch -p0; done

./configure --prefix=/usr \
--bindir=/bin \
--htmldir=/usr/share/doc/bash-4.2 \
--without-bash-malloc \
--with-installed-readline

make && make install

Once this was done, I ran the following command again:

env X="() { :; } ; echo busted" /bin/bash -c "echo stuff"

The output now reports an error, showing that bash is patched.

/bin/bash: warning: X: ignoring function definition attempt
/bin/bash: error importing function definition for `X'

Your mileage may vary. As with all updates of this sort, be sure you have a backup plan in case something goes awry.

  • Target

    NICE!!
    But I found this problem compiling:

    bashline.o: In function `initialize_readline':
    /opt/installate/bash-4.2/bashline.c:516: undefined reference to `rl_filename_rewrite_hook’
    bashline.o: In function `bash_dabbrev_expand':
    /opt/installate/bash-4.2/bashline.c:3056: undefined reference to `rl_sort_completion_matches’
    /opt/installate/bash-4.2/bashline.c:3052: undefined reference to `rl_menu_completion_entry_function’
    /opt/installate/bash-4.2/bashline.c:3058: undefined reference to `rl_menu_completion_entry_function’
    /opt/installate/bash-4.2/bashline.c:3063: undefined reference to `rl_sort_completion_matches’
    /opt/installate/bash-4.2/bashline.c:3073: undefined reference to `rl_menu_completion_entry_function’
    /opt/installate/bash-4.2/bashline.c:3077: undefined reference to `rl_sort_completion_matches’
    pcomplete.o: In function `bind_compfunc_variables':
    /opt/installate/bash-4.2/pcomplete.c:911: undefined reference to `rl_completion_invoking_key’
    collect2: ld returned 1 exit status
    make: *** [bash] Error 1

    Have you got any idea?

  • Tester876

    Target…. I am getting a similar error. Any luck?

  • slapshot

    Here we go again. I have a FC8 server in production as well and this time it is the Ghost exploit. I came by to see if you had posted your fix yet since I think we will need to update several files (glibc, glibc-headers, glibc-devel, and glibc-common). I really wish I updated this server long ago.

  • Mathew

    Thank you. That worked for me/