26 Sep
2014
26 Sep
'14
5:01 p.m.
From: "Rohan McLeod" <rhn(a)jeack.com.au>
Any news regarding mobile phones and routers etc ?
I have an older QNAP NAS appliance (used for backup) that is vulnerable as
well.
The web interface died four weeks ago so it seems to be time to retire it
anyway;-)
AFAIK Busybox uses ash. That should be okay for some appliances.
On an Apple, I wonder what breaks if you point sh and bash to ksh (until
the fix comes in) Probably not much.
Regards
Peter
26 Sep
26 Sep
5:07 p.m.
New subject: bash 'Shell Shock' vulnerability
Peter Ross wrote:
From: "Rohan McLeod"
<rhn(a)jeack.com.au>
Actually, the QNAP appliances is using BusyBox I realized.
So Busyboxes are affected too. At least the one example I have in reach.
Regards
Peter
Any news regarding mobile phones and routers etc
?
I have an older QNAP NAS appliance (used for backup) that is vulnerable as
well.
AFAIK Busybox uses ash. That should be okay for some appliances. 
6:34 p.m.
New subject: bash 'Shell Shock' vulnerability
On 26/09/2014 5:01 PM, Peter Ross wrote:
From: "Rohan McLeod"
<rhn(a)jeack.com.au>
Why not run Debian on it?
I used funplug on my old D-Link DNS343 NAS units, one of two out of
service now, the other out of service soon -- NOT Internet accessible at
all.
I've installed Debian Wheezy on Thecus N4800eco units now, these were to
replace the D-Link gear.
Any news regarding mobile phones and routers etc
?
I have an older QNAP NAS appliance (used for backup) that is vulnerable as
well. On an Apple, I wonder what breaks if you point sh and
bash to ksh (until
the fix comes in) Probably not much.
Apple had another great fail with iOS 8.0.1 -- apparently the same
person approved it as for their maps debacle; at least they've got 8.0.2
out now (not that I use any iDevice myself). I don't expect Apple to be
quick with a fix, OS X Mavericks is quite old for openssl too, too old
for heartbleed.
In the past when Apple made themselves responsible for their /own/ Java
builds, they were very slow to fix them as well.
Suffice to say, I wouldn't count on /perfect/ Apple to fix this bash
problem quickly, but I would be happy to be proved wrong.
Cheers
A.
27 Sep
27 Sep
6:07 p.m.
New subject: bash 'Shell Shock' vulnerability
On 26/09/2014 6:34 PM, Andrew McGlashan wrote:
In the past when Apple made themselves responsible for
their /own/ Java
builds, they were very slow to fix them as well.
No change to bash from 10.9.4 to 10.9.5, of course that OS X update
wasn't expected to update bash. No further updates are available from
Apple yet.
Cheers
A.
3107
days inactive
3108
days old
3 comments
2 participants
participants (2)
-
Andrew McGlashan -
Peter Ross