cPanelSSP/SSP — pull request #32 by cPanelChrisD (2014-09-24 20:01:30+00:00)
Title: Bash code injection vulnerability check, other minor fixes

===

ADDED - Check for Bash 2014-09-24 security advisory vulnerability.

[CRIT] * Installed 'bash' shell is vulnerable to remote code injection. Verify by running the following at a shell prompt, it should return "vulnerable":
env x='() { :;}; echo vulnerable' bash -c ""
Send customer this premade: "Bash advisory 2014-09-24 - Discovery"

Requested by:
Chris Borsheim

===

UPDATED - The bug report template printed by --bugreport now includes the ticket number copied off the end of the HISTFILE environment variable set by the ticket login servers, if it exists.

Great idea provided by:
Peter Elsner

===

ADDED - A "Did you know?" item to advertise SSP's new --bugreport option.

Requested by:
Chris Borsheim

===

UPDATED - Some DNSONLY server checks need RPM info just like non-DNSONLY servers but it wasn't gathering this information. The OpenSSL security checks that needed this data would have just silently skipped the checks if the data was missing. This change should allow the OpenSSL vulnerability checks to function on DNSONLY servers. Noticed while I was adding the bash check that this was a problem.

===