forum.excito.org

Does anyone know of a package for the B3 that has the new NTP bug fixes?

It would probably be good to scan your http logs for probes such as:

89.207.135.125 - - [24/Sep/2014:23:08:56 -0700] "GET /cgi-sys/defaultwebpage.cgi HTTP/1.0" 301 338 "-" "() { :;}; /bin/ping -c 1 198.101.206.138"

Real world exploits here:

http://www.kernelmode.info/forum/viewto ... 505#p23987

A great explanation of the where the risk really starts (from a SlashDot post):

Suppose you have pwd.cgi, which prints the name of the current directory:

#!/bin/sh
echo -e "Content-type: text/plain\n\n"
pwd

Notice the script uses no input at all. It is potentially vulnerable. Here's why. Suppose ...

I like running the RoundCube webmail service on my B3. It uses bash and apache to serve pages.

I would gladly post a URL or two showing more detail on the exploit, but this forum editor won't allow me to submit them.

There is a security vulnerability in the bash shell, and I have verified that my B3 is vulnerable.

Will there be a new package available for the B3?

I am a new B3 owner and am struggling to get virtual email domains to work on my B3. Does anyone know of a how-to document?

I need to receive email for two different domains and separate the email into Maildir folders.

Thanks.

- David