<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">On 09/25/2014 06:10 PM, Alan W. Irwin
wrote:<br>
</div>
<blockquote
cite="mid:alpine.DEB.2.02.1409251741010.21017@enira.zlyna.ubzr"
type="cite">Furthermore,
<br>
<br>
irwin@raven> ls -l /bin/sh
<br>
lrwxrwxrwx 1 root root 4 Mar 1 2012 /bin/sh -> dash*
</blockquote>
On OpenSuse 13.1 all scripts, about 450, are bash. However the test:<br>
<br>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
<pre style="white-space: pre-wrap; word-wrap: break-word; color: rgb(57, 57, 57); font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255);">env X="() { :;} ; echo busted" /bin/sh -c "echo stuff"
shows that the system is not vulnerable. I guess I must be up to date.
John
</pre>
<pre class="moz-signature" cols="72">--
John Blomfield
Delivered by Thunderbird Email on Linux OpenSuse-KDE4
Old John B's Linux Notes <a class="moz-txt-link-freetext" href="http://www.oldjohnbslinux.wordpress.com">http://www.oldjohnbslinux.wordpress.com</a>
</pre>
</body>
</html>