On: Shellshock DHCP Remote Code Execution – Proof of C...

[dfc]

Debian's default /bin/sh is not "really bash," it is dash. The same is true for many embedded distros based on busybox.

[mct → dfc]

While this is generally true of newer Debian installations, older machines that have been been regularly updated over the years to stable may still have /bin/sh pointing to bash. I fixed a few of my machines yesterday to use dash.

[dfc → mct]

dash changelog.Debian.gz entry from July 22nd, 2009:

  * Change the default for the system shell to dash.
  * Ship /bin/sh in the package and fix the diversion handling
    for it to make sure /bin/sh is always present.
  * Set debconf priority to high when upgrading from an existing
    system.

Unless the admin has--for some bizarre reason--set debconf to critical; during one of those "regular updates" the admin would have been presented with the following question:

  The system  shell is the default  command interpreter for 
  shell scripts.                                            
                                                
  Using  dash   as  the  system  shell   will  improve  the
  system's overall performance. It does not alter the shell
  presented to interactive users.   

  Use dash as the default system shell (/bin/sh)?

      <Yes>      <No>

[vertex-four → dfc]

This assumes that the admin is administering their systems by running apt-get update && apt-get upgrade manually, rather than some automated process.

[dfc → vertex-four]

What automated process for Debian administration is unaware of debconf?

This is a honest question. How could an automated Debian administration process not be aware of and interact on some level with debconf?

[vertex-four → dfc]

Does this change default to "yes" on unattended installs? I'd assume it doesn't, because that would be dangerous.

EDIT: Indeed, from the same changelog: debian/dash.NEWS.Debian: when upgrading existing installations, the system shell will not be changed automatically (closes:#539363).

[dfc → vertex-four]

Just so we are clear you would be talking about an unattended dist-upgrade from lenny to squeeze? Have you done this?

Please explain how your automated Debian administration system that has been in place since Lenny[^1] handles unattended dist-upgrades without the use of preseeding the debconf database for questions with a priority of high or critical?

[^1]: Squeeze was February 2011, any new stable installation since squeeze defaulted to dash as /bin/sh

EDIT: Nevermind, I answered my own question, unattended dist-upgrades from Lenny to squeeze is not something you have any experience with: "I'm now using Debian Wheezy, after primarily using Windows environments my entire life." https://news.ycombinator.com/item?id=6564610#up_6565766