ShellShock - bash already updated?

Question

I'm trying to fix this new ShellShock bug on my PC (running Ubuntu 14.04). From what I've gathered, the simplest way to do this is to just update bash via the terminal (I've tested my system for the vulnerability, its there I'm afraid).

What I've tried:

sudo apt-get update
sudo apt-get install bash
which led to the following output:

...
Building dependency tree       
Reading state information... Done
bash is already the newest version.
0 upgraded, 0 newly installed, 0 to remove and 1 not upgraded.

I've also attempted the following:

sudo apt-get update && sudo apt-get install --only-upgrade bash

Showed the same output.

Any idea how can I fix this?

Solution

A simple restart did it.

Even if you close the terminal, there might be some old instances of bash still active in background, So just restart bash (I would rather just restart overall) and everything should be OK.

To sum it up, here is how to make sure you're safe:

1. Run the following in terminal:

   env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
   

this is simply to make sure you're actually vulnerable (the output should be "vulnerable this is a test").

2. Update bash and your packages:

   sudo apt-get update && sudo apt-get install bash
   

3. Restart your system (or restart bash completely - don't just close the terminal!)

4. Open the terminal after the reboot - run the above test again. The result you should see now is "this is a test".

Good luck

Comments

[g_p]

Please add output of apt-cache policy bash in your question.

[s3lph]

And bash --version. Mine has version 4.3.11(1).

[thirtythreeforty]

"Bash doesn't just 'terminate' when you close your terminal - its still active in background..." This is not true. What happens is that there are other processes still using instances of the old version of Bash. When you close/reopen your terminal, you're launching a fresh copy of (the now patched) Bash. There is not some single master copy of Bash running somewhere. However, you are correct that a system restart will purge all the old Bash instances.

[Matanoga]

roger that. editing.

[Marnix A. van Ammers]

Instead of closing the terminal, you could also, type "exec /bin/bash -login" .

[user]

So would "exec /bin/bash -login" replace all running instances of bash with the newer (patched) version, and remove the need for a reboot? How would it affect processes using the old version of bash - would there be any downtime? This needs to be done on a production box.