Bash - "Shellshock" Vulnerability

[Carme Torca]

Hi,

I would like to know if I have tot put any patch on servers with HP-UX 11.31 or 11.23

In HPUX 11i I have seen that is not affected, but I doesn't know if 11i v2 or 11i v3 are affected.

http://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay/?spf_p.tpst=kbDocDisplay&spf_p.prp_kbDocDisplay=wsrp-navigationalState%3DdocId%253Demr_na-c04465135-1%257CdocLocale%253Den_US%257CcalledBy%253DSearch_Result&javax.portlet.begCacheTok=com.vignette.cachetoken&javax.portlet.endCacheTok=com.vignette.cachetoken

Thanks a lot of,

Carmen.

P.S. This thread has been moved from General to HP-UX > security. - Hp Forum Moderator

[Robert Herron · Accepted solution]

HP doesn't include BASH with any version of HP-UX. 

You can download an updated BASH for HP-UX at http://hpux.connect.org.uk/hppd/hpux/Shells/bash-4.3.027/

[pooderbill]

As mentioned, BASH is not supplied with HP-UX. The primary shells are ksh (Korn 1988) and POSIX shell and neither have the vulnerability.

[Carme Torca]

Thank you very much!!!

Regards!

[RJHall]

Anybody still using the TC-OpenSource bundle for 11.11 should be concerned since it contains an old Bash shell release--version 2.04.