# ShellShock with SLES10/SLES11 **URL:** \ **Category:** SLES Configure-Administer\ **Created:** [September 26, 2014, 10:31am UTC](https://forums.suse.com/t/shellshock-with-sles10-sles11/26137 "2014-09-26T10:31:29Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![swadm](https://avatars.discourse-cdn.com/v4/letter/s/bc79bd/32.png) [@swadm](https://forums.suse.com/u/swadm)\ **Post date:** [September 26, 2014, 10:31am UTC](https://forums.suse.com/t/shellshock-with-sles10-sles11/26137/1 "2014-09-26T10:31:29Z")
you certainly have heard about [http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-6271](http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-6271), probably also the successor [http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-7169](http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-7169) I wonder if Novell will publish a free version of a SLES10 SP4 fix: the relevant patches in [http://support.novell.com/security/cve/CVE-2014-6271.html](http://support.novell.com/security/cve/CVE-2014-6271.html) are all locked and restricted to LTSS customers. Furthermore I wonder when a patch for CVE-2014-7169 will be made available. FreeBSD and Debian 7 are already done, but [https://bugzilla.novell.com/show\_bug.cgi?id=898346](https://bugzilla.novell.com/show_bug.cgi?id=898346) sounds not so promising: “Please submit fixed packages until 2014-10-03” Cheers, Thomas ---
**Author:** ![malcolmlewis](https://sea2.discourse-cdn.com/flex022/user_avatar/forums.suse.com/malcolmlewis/32/11375_2.png) [@malcolmlewis](https://forums.suse.com/u/malcolmlewis)\ **Post date:** [September 26, 2014, 2:34pm UTC](https://forums.suse.com/t/shellshock-with-sles10-sles11/26137/2 "2014-09-26T14:34:05Z")
[QUOTE=swadm;23847]you certainly have heard about [http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-6271](http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-6271), probably also the successor [http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-7169](http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-7169) I wonder if Novell will publish a free version of a SLES10 SP4 fix: the relevant patches in [http://support.novell.com/security/cve/CVE-2014-6271.html](http://support.novell.com/security/cve/CVE-2014-6271.html) are all locked and restricted to LTSS customers. Furthermore I wonder when a patch for CVE-2014-7169 will be made available. [/QUOTE] Hi I would assume, out of support and self support come into play, you should have a look on the Open Build Service… [http://software.opensuse.org/search?utf8=✓&q=bash&search\_devel=false&search\_devel=true&search\_unsupported=false&baseproject=ALL](http://software.opensuse.org/search?utf8=%E2%9C%93&q=bash&search_devel=false&search_devel=true&search_unsupported=false&baseproject=ALL) > [@swadm;23847](#): > > FreeBSD and Debian 7 are already done, but [https://bugzilla.novell.com/show\_bug.cgi?id=898346](https://bugzilla.novell.com/show_bug.cgi?id=898346) sounds not so promising: > “Please submit fixed packages until 2014-10-03” This is normal auto generated text by the package update mechanism, packages are generally in the works when you see this… AFAIK from Mailing List traffic, this is not as critical [http://lists.opensuse.org/opensuse/2014-09/msg00615.html](http://lists.opensuse.org/opensuse/2014-09/msg00615.html) ---
**Author:** ![swadm](https://avatars.discourse-cdn.com/v4/letter/s/bc79bd/32.png) [@swadm](https://forums.suse.com/u/swadm)\ **Post date:** [September 29, 2014, 9:28am UTC](https://forums.suse.com/t/shellshock-with-sles10-sles11/26137/3 "2014-09-29T09:28:52Z")
Patch appears to be available now: [https://bugzilla.novell.com/show\_bug.cgi?id=898346](https://bugzilla.novell.com/show_bug.cgi?id=898346) SUSE-SU-2014:1247-1: An update that fixes three vulnerabilities is now available. Category: security (important) Bug References: 898346,898603,898604 CVE References: CVE-2014-7169,CVE-2014-7186,CVE-2014-7187 Sources used: SUSE Linux Enterprise Software Development Kit 11 SP3 (src): bash-3.2-147.22.1 SUSE Linux Enterprise Server 11 SP3 for VMware (src): bash-3.2-147.22.1 SUSE Linux Enterprise Server 11 SP3 (src): bash-3.2-147.22.1 SUSE Linux Enterprise Server 11 SP2 LTSS (src): bash-3.2-147.14.22.1 SUSE Linux Enterprise Server 11 SP1 LTSS (src): bash-3.2-147.14.22.1 SUSE Linux Enterprise Server 10 SP4 LTSS (src): bash-3.1-24.34.1 SUSE Linux Enterprise Server 10 SP3 LTSS (src): bash-3.1-24.34.1 SUSE Linux Enterprise Desktop 11 SP3 (src): bash-3.2-147.22.1 ---
**Author:** ![swadm](https://avatars.discourse-cdn.com/v4/letter/s/bc79bd/32.png) [@swadm](https://forums.suse.com/u/swadm)\ **Post date:** [September 29, 2014, 11:48am UTC](https://forums.suse.com/t/shellshock-with-sles10-sles11/26137/4 "2014-09-29T11:48:38Z")
interestingly, on [https://www.suse.com/support/kb/doc.php?id=7015702](https://www.suse.com/support/kb/doc.php?id=7015702) we read [QUOTE] “Due to the nature of this issue, it was decided that patches would be made available to customers who don’t have an LTSS agreement or not for SLES10SPx and SLES11SPx. For further information about this, please contact Customer Support.” [/QUOTE] Thus, the patch is also available to non-LTTS customers, but they need to contact support. Also, [https://www.suse.com/support/shellshock/](https://www.suse.com/support/shellshock/) has additional information. HTH, Thomas