我想了解如何在cygwin上应用此漏洞的修复程序。
我正在CYGWIN_NT-6.1 MYHOSTNAME 1.7.30(0.272/5/3) 2014-05-23 10:36 x86_64 Cygwin
Windows 7上运行cygwin。
#bash -version
GNU bash, version 4.1.11(2)-release (x86_64-unknown-cygwin)
Copyright (C) 2009 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
$ env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
vulnerable
this is a test
我尝试了apt-cyg,但没有更新任何内容:
$ apt-cyg update bash
apt-cyg update bash
Working directory is /setup
Mirror is http://mirrors.kernel.org/sourceware/cygwin
--2014-09-25 09:24:14-- http://mirrors.kernel.org/sourceware/cygwin/x86_64/setup.bz2
Resolving mirrors.kernel.org (mirrors.kernel.org)... 149.20.4.71, 149.20.20.135, 2001:4f8:1:10:0:1994:3:14, ...
Connecting to mirrors.kernel.org (mirrors.kernel.org)|149.20.4.71|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 431820 (422K) [application/x-bzip2]
Saving to: ‘setup.bz2’
100% [======================================================================================>] 431,820 898KB/s in 0.5s
2014-09-25 09:24:14 (898 KB/s) - ‘setup.bz2’ saved [431820/431820]
Updated setup.ini
当尝试通过运行setup-x86_64.exe
并通过向导在外壳下显示的bash重新安装bash进行重新安装时,似乎开始下载所有内容。它应该是非常快速的更新,但是开始下载超过15分钟,然后我取消了它。我环顾了https://cygwin.com
站点和其他论坛,但到目前为止,没有针对此漏洞的任何特定更新。
C:\Cygwin64\Downloads` but not
C:\ Cygwin64`