Hi! Please sign in Home >  Support > Technical FAQs

Technical FAQs
Question Shellshock Patch - Embedded Computers (X86-based, Debian 5)
Question Type Application ,Function ,Other ,Specifications
Updated 9/5/2017 6:01:23 PM
Hits 1
Products DA-682,V2406,V2101,V2422,DA-710,V2426,V2401/V2402 Series,DA-681,DA-683,V2416,V2616,V2406-24I,DA-685
Suggestions

To solve the Shellshock issue on your Debian 5 embedded computer, use one of the following patch update methods:
Off-line
Online

Off-line Patch Update Method:
1. Download the Shellshock Patch Embedded Computers (X86, Debian 5).zip file from the Moxa website at https://www.moxa.com/support/download.aspx?type=support&id=7770.

2. Unzip the ZIP file.

3. Upload the dpkg -i bash_3.2-5_i386.deb file to the /home directory on your target computer.

4. Run the following command:
#dpkg -i bash_3.2-5_i386.deb


Online Patch Update Method:
1. Make sure that your embedded computer has access to the Internet.

2. Unzip the ZIP file.

3. Download the Shellshock Patch Embedded Computers (X86, Debian 5).zip file from the MOXA website at https://www.moxa.com/support/download.aspx?type=support&id=7770.

4. Edit the sources.list file.
# mount -o, remount,rw /
#vi /etc/apt/sources.list

5. Add the MOXA Debian server list in the sources.list file.
deb http://debian.moxa.com/debian/ lenny main

Note: If you are unable to access the web site using the fully qualified domain name, add the following line in the sources.list file:
          deb http://220.135.161.42/debian/ lenny main


6. From the Shellshock Patch Embedded Computers (X86, Debian 5).zip file, add the MOXA Debian server public key (NEW-MOXA-SYS-DEBIAN-KEY) to the /home/ directory on your target computer and update the list.
#apt-key add NEW-MOXA-SYS-DEBIAN-KEY
#apt-get update

If the public key is added successfully, the screen displays “OK.”
# apt-key add NEW-MOXA-SYS-DEBIAN-KEY
OK

7. Install the new bash package.
#apt-get install bash

Verification:
To verify that the issue has been resolved, perform one of the following actions:
• Enter the dpkg -l |grep bash command to check that Bash has been updated to the latest version (3.2-5).
# dpkg -l |grep bash
ii bash 3.2-5
The GNU Bourne Again SHell
ii bash-completion 20080705
programmable completion for the bash shell

• Run the following script.
env 'x=() { :;}; echo vulnerable' 'BASH_FUNC_x()=() { :;}; echo vulnerable' bash -c "echo test"

If the word “test” displays on the screen, this indicates that Bash is updated successfully.

Note:
1. Check the following web page on the official Debian website for information related to the Shellshock patch (CVE-2014-6271): https://security-tracker.debian.org/tracker/CVE-2014-6271
2. For questions concerning our products and services, please contact MOXA Technical Service: https://www.moxa.com/support/request_support.aspx
 

Related Questions
Provide Feedback
Quality of this article
Poor                Excellent