As I had said in the first message last week,  the initial patch was not a complete fix.

So this is the 3rd BASH update for a cure for variants of remote code execution.

Again, most likely not the last.

So most of you just need to:

# "  YUM UPDATE BASH  "  -for app_rpt   -for the latest patch  -AGAIN

Many of you, like myself, have many other servers online outside of app_rpt servers.

Many of us run other asterisk and web servers.

Asterisk SIP Proxies may be venerable to shellshock  (sipshock) see link at bottom of msg for tests.

If you have other servers online, you should monitor for future updates as someone "MAY" publish a remote code execution hack used even after the last patch (patch # 2) was applied. It is unknown to me "at time of post" if that is the same exploit as patch #3 fixes.

My experience has been, at least on a couple of servers that seem to have everyday hack attempts, that when a new exploit is discovered, it is soon tried on those servers within a few days.

It's not "what is known" that bothers me about this kinda thing, but what is not known...  ...YET.

The fact that a big hole was found in something as basic as BASH, will cause many a hacker to try hacks with other basic services. Especially with code that was written more than a decade ago. You just need to be on your toes about general security permissions and limiting services to "just what is needed" on your servers (just a suggestion).

Read/test for yourself and update as needed.

Just a FYI.

...mike/kb8jnm