Active Topics
-
Sailfish OS for the Motorola Moto G7 Power (XT1955-5) - (ocean) (3)
to SailfishOS by edp17 - 5 hrs, 34 mins ago -
The N900 is now 15 years old! (6)
to Nokia N900 by Macros - 1 day, 9 hrs ago -
F(x)tec Pro1x (QWERTY) for sale (0)
to Buy & Sell by aln00000 - 1 day, 22 hrs ago -
n770 youtube video (0)
to General by nmdv - 5 days, 21 hrs ago - more...
 |
jellyroll |
2014-09-28
, 11:59
|
|
Posts: 435 |
Thanked: 684 times |
Joined on Apr 2012
@ Netherlands 020
|
#21
|
Will there be a bash update for Maemo?
| The Following 2 Users Say Thank You to jellyroll For This Useful Post: | ||
 |
|
2014-09-28
, 21:03
|
|
Posts: 5,028 |
Thanked: 8,613 times |
Joined on Mar 2011
|
#22
|
Originally Posted by szopin
Agreed. But the bash availability on N900 is hardly a replacement for busybox upgrade (and we're stuck with busybox as core /bin/sh, no matter if we like it, or not), it's just nice additional thing to have.
We can afford running full blown (pun unintended) and featured linux distro with the latest and greatest (gplv3 even)
Now, some people argued that we don't need upstream updates to busybox (including security ones) - that busybox-power provides - in CSSU, cause we can install bash, anyway. Which is assumption broken by design, as we can either use bash AND still have ash as core /bin/sh, or only use ASH for everything.
Summing it up, my whole point was that bash isn't "cure for your all shell related needs, cancer, poverty, and all world problems combined", especially on N900. It doesn't substitute busybox updates, and busybox-power SHOULD be part of CSSU. Shame on CSSU maintainers that it isn't as there are no rational/meritocratic reasons for it, only political bash-loving and ash-hating (and letting arrogant buffoons to act as CSSU advisors *waves to joerg*, which fortunately, is thing of the past, already).
/Estel
__________________
N900's aluminum backcover / body replacement
-
N900's HDMI-Out
-
Camera cover MOD
-
Measure battery's real capacity on-device
-
TrueCrypt 7.1 | ereswap | bnf
-
Hardware's mods research is costly. To support my work, please consider donating. Thank You!
N900's aluminum backcover / body replacement
-
N900's HDMI-Out
-
Camera cover MOD
-
Measure battery's real capacity on-device
-
TrueCrypt 7.1 | ereswap | bnf
-
Hardware's mods research is costly. To support my work, please consider donating. Thank You!
| The Following User Says Thank You to Estel For This Useful Post: | ||
|
|
2014-10-02
, 02:56
|
|
Posts: 96 |
Thanked: 80 times |
Joined on May 2010
|
#23
|
This argument is all very interesting, but can anyone provide a simple answer to the question of whether a bash update is likely to become available, and/or should I try to make one myself?
|
|
2014-10-02
, 06:59
|
|
Posts: 1,808 |
Thanked: 4,272 times |
Joined on Feb 2011
@ Germany
|
#24
|
Originally Posted by avidscavenger
I don't think anybody runs a priviledged web server with CGI support and bash as standard shell on the N900. So it's not likely that people will be running for the update.
This argument is all very interesting, but can anyone provide a simple answer to the question of whether a bash update is likely to become available, and/or should I try to make one myself?
But feel free to do it yourself
| The Following 6 Users Say Thank You to reinob For This Useful Post: | ||
|
|
2014-10-05
, 00:10
|
|
Posts: 78 |
Thanked: 84 times |
Joined on Aug 2012
|
#25
|
Originally Posted by reinob
No webserver but I do have bash, ssh and a DHCP client. So that makes me vulnerable.
I don't think anybody runs a priviledged web server with CGI support and bash as standard shell on the N900.
| The Following 2 Users Say Thank You to independent For This Useful Post: | ||
|
|
2014-10-05
, 15:49
|
|
Posts: 1,808 |
Thanked: 4,272 times |
Joined on Feb 2011
@ Germany
|
#26
|
Originally Posted by independent
If ssh worries you be sure to comment out any AcceptEnv options in your sshd_config
No webserver but I do have bash, ssh and a DHCP client. So that makes me vulnerable.
I'm not aware of any DHCP attack vector. Anyway, I don't think *anything* in Maemo, including the DHCP client, require bash (because it's not even installed by default), so you should be "OK".
But again, feel free to compile the latest bash. I'll see if I can do it quickly myself though.
| The Following 5 Users Say Thank You to reinob For This Useful Post: | ||
|
|
2014-10-05
, 18:08
|
|
Posts: 1,808 |
Thanked: 4,272 times |
Joined on Feb 2011
@ Germany
|
#27
|
So, here's the latest bash 4.3 with all 29 patches compiled (without NLS) for armel. It doesn't really need anything in terms of dependencies (although it is NOT statically compiled).
Just unpack it and put it in /usr/local/bin or wherever you find it convenient.
PS: now that "we" control TMO, can we please remove these absurd restrictions on file extension and/or attachment size?
Last edited by reinob; 2014-10-05 at 19:48. Reason: s/one/can/
Just unpack it and put it in /usr/local/bin or wherever you find it convenient.
PS: now that "we" control TMO, can we please remove these absurd restrictions on file extension and/or attachment size?
Last edited by reinob; 2014-10-05 at 19:48. Reason: s/one/can/
| The Following 16 Users Say Thank You to reinob For This Useful Post: | ||
|
|
2014-10-07
, 11:08
|
|
Posts: 1,994 |
Thanked: 3,342 times |
Joined on Jun 2010
@ N900: Battery low. N950: torx 4 re-used once and fine; SIM port torn apart
|
#28
|
Originally Posted by reinob
Quick reply...
PS: now that "we" control TMO, can we please remove these absurd restrictions on file extension and/or attachment size?
Can you imagine the huge, heavy photographs and drawings that will quickly appear here, and overwhelm the storage?..
Seriously, we should ask techstaff about this. Where can we find the current bugs and feature requests of Maemo server? Is there https support in the works?
Best wishes. Thank you!
~~~~~~~~~~~~~~~~~
Per aspera ad astra...
|
|
2014-10-07
, 13:55
|
|
Posts: 1,808 |
Thanked: 4,272 times |
Joined on Feb 2011
@ Germany
|
#29
|
Originally Posted by Wikiwide
Good points. If at all, I would just hope that we can upload a .tar.gz. Surprising and annoyingly, this is not allowed (zip and gz are OK though for some reason).
Quick reply...
Can you imagine the huge, heavy photographs and drawings that will quickly
appear here, and overwhelm the storage?..
Seriously, we should ask techstaff about this. Where can we find the current bugs and feature requests of Maemo server? Is there https support in the works?
And well, maybe a bit more than 800Kb would be fine..
Once techstaff sort their stuff out (if it hasn't been done yet) we could have an idea of how much space we need. I'll happily donate for another HDD or two.
|
|
2014-10-08
, 14:11
|
|
Posts: 1,808 |
Thanked: 4,272 times |
Joined on Feb 2011
@ Germany
|
#30
|
Quick heads up. There's a new patch for bash (#30, dated October 5th). When I get some time I'll post an updated version.
Add. here it is!
Add. It passes all current tests:
Last edited by reinob; 2014-10-08 at 14:28.
Add. here it is!
Add. It passes all current tests:
Code:
$ curl https://shellshocker.net/shellshock_test.sh | bash CVE-2014-6271 (original shellshock): not vulnerable CVE-2014-6277 (segfault): not vulnerable CVE-2014-6278 (Florian's patch): not vulnerable CVE-2014-7169 (taviso bug): not vulnerable CVE-2014-7186 (redir_stack bug): not vulnerable CVE-2014-7187 (nested loops off by one): not vulnerable CVE-2014-//// (exploit 3 on http://shellshocker.net/): not vulnerable $
Last edited by reinob; 2014-10-08 at 14:28.
| The Following 15 Users Say Thank You to reinob For This Useful Post: | ||
 |
| Tags |
| maemo 5, shellshock |
«
Previous Thread
|
Next Thread
»
| Thread Tools | |
|
All times are GMT. The time now is 18:35.