IPFire 2.15 Core Update 83 released

[The IPFire Project <ipfire-announce@lists.ipfire.org>]

[-- Attachment #1: Type: text/plain, Size: 2003 bytes --]

http://www.ipfire.org/news/ipfire-2-15-core-update-83-released

This is the official release announcement for IPFire 2.15 Core Update
83. It mainly provides a fix for several security issues in the GNU bash
package [1] also known as "ShellShock" and filed under CVE-2014-6271 and
CVE-2014-7169.


ShellShock

It was possible to inject shell commands that were executed from the
shell environment. IPFire uses CGI scripts for its web user interface.
Therefore it was possible for authenticated users to execute shell
commands with non-root privileges and of course users that had access to
the shell on command line. Also other services that execute shell
scripts like the DHCP client were vulnerable.

We regard this as a serious security issue and recommend to update as
soon as possible. Please do not forget to reboot your machine afterwards
and check for updates for your other *nix distribution as well because
they are probably vulnerable, too.

It appears that there might be more problems in GNU bash for which there
is no working fix available right now. So please stay tuned for more
updates.

Further information about this error can be found on: [2] and [3]


Misc

* squid - the Web Proxy - has been updated to version 3.4.7 due to
  various security and stability fixes
* Several security and stability fixes have been added to glibc
* The URL to detailed descriptions of the snort alerts has been updated
* Various minor bug fixes.

----

Thanks to all who provided us with feedback about their testing results.
Please support future security fixes by sending us a donation [4].


[1] http://planet.ipfire.org/post/fixing-the-gnu-bash-vulnerability-cve-2014-6271
[2] http://arstechnica.com/security/2014/09/bug-in-bash-shell-creates-big-security-hole-on-anything-with-nix-in-it/
[3] http://www.heise.de/newsticker/meldung/ShellShock-Standard-Unix-Shell-Bash-erlaubt-das-Ausfuehren-von-Schadcode-2403305.html
[4] http://www.ipfire.org/donate

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 819 bytes --]