IPFire 2.15 Core Update 83 released

The IPFire Project ipfire-announce at lists.ipfire.org
Sun Sep 28 19:51:13 CEST 2014


http://www.ipfire.org/news/ipfire-2-15-core-update-83-released

This is the official release announcement for IPFire 2.15 Core Update
83. It mainly provides a fix for several security issues in the GNU bash
package [1] also known as "ShellShock" and filed under CVE-2014-6271 and
CVE-2014-7169.


ShellShock

It was possible to inject shell commands that were executed from the
shell environment. IPFire uses CGI scripts for its web user interface.
Therefore it was possible for authenticated users to execute shell
commands with non-root privileges and of course users that had access to
the shell on command line. Also other services that execute shell
scripts like the DHCP client were vulnerable.

We regard this as a serious security issue and recommend to update as
soon as possible. Please do not forget to reboot your machine afterwards
and check for updates for your other *nix distribution as well because
they are probably vulnerable, too.

It appears that there might be more problems in GNU bash for which there
is no working fix available right now. So please stay tuned for more
updates.

Further information about this error can be found on: [2] and [3]


Misc

* squid - the Web Proxy - has been updated to version 3.4.7 due to
  various security and stability fixes
* Several security and stability fixes have been added to glibc
* The URL to detailed descriptions of the snort alerts has been updated
* Various minor bug fixes.

----

Thanks to all who provided us with feedback about their testing results.
Please support future security fixes by sending us a donation [4].


[1] http://planet.ipfire.org/post/fixing-the-gnu-bash-vulnerability-cve-2014-6271
[2] http://arstechnica.com/security/2014/09/bug-in-bash-shell-creates-big-security-hole-on-anything-with-nix-in-it/
[3] http://www.heise.de/newsticker/meldung/ShellShock-Standard-Unix-Shell-Bash-erlaubt-das-Ausfuehren-von-Schadcode-2403305.html
[4] http://www.ipfire.org/donate
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: This is a digitally signed message part
URL: <http://lists.ipfire.org/pipermail/ipfire-announce/attachments/20140928/815b189e/attachment.sig>


More information about the IPFire-Announce mailing list