Re: Shellshock

Mike Cunningham <mike.cunningham@xxxxxxx> wrote on Mon, 29 Sep
2014 22:31:22 GMT:

Has anyone confirmed for sure if ibm i os needs to worry about
the shellshock bug?

Only if you have explicity installed GNU bash or you have
installed another service which included GNU bash.

From Terry Ford, an expert on IBM i security in Lab Services who

reached out to someone in development:

If you wish to check your IBM i systems, the easiest way is to
search for the 'bash' binary by doing the following:

CALL QP2TERM (i.e. invoke an interactive PASE session)

Run the following commands from PASE. Note the find command will
probably take some time to run.

cd /
find . -name bash

On my particular system the find command returned this result:

./QOpenSys/usr/bin/bash

I then ran the following command to verify where the bash binary
was installed:

ls -l
/QOpenSys/usr/bin/bash

lrwxrwxrwx 1 rwatkin 0 54 May 25 2011
/QOpenSys/usr/bin/bash -> ../../opt/freeware/bin/bash

End result: Bash is installed here /opt/freeware/bin/bash. From
personal experience I know that this is the location used when
installing some of the open source binaries using one of the
methods documented on the Yips website...

www.youngiprofessionals.com/wiki/index.php/PASE/OpenSourceBinari
es