Mon, 29 Sep 2014
CVE-2014-6271 fix for Debian woody, sarge, etch and lenny
Very old Debian releases like woody (3.0), sarge (3.1), etch (4.0) and lenny (5.0) are not supported anymore by the Debian Security Team and do not get security updates. Since some of our customers still have servers running these version, I have built bash packages with the fix for CVE-2014-6271 (the "shellshock" bug) and Florian Weimer's patch which restricts the parsing of shell functions to specially named variables:
http://ftp.linux.it/pub/People/md/bash/
This work has been sponsored by my employer Seeweb, an hosting, cloud infrastructure and colocation provider.