Build bash from source for Debian etch distributions

build-bash-etch.sh

# I didn't write this, I just adapted it from the lenny version: https://gist.github.com/href/54859127c183f67f947f
# inspired by http://askubuntu.com/a/528171
 
# prerequisites
sudo apt-get install bison
 
# get bash 3.1 source
mkdir src && cd src
wget http://ftp.gnu.org/gnu/bash/bash-3.1.tar.gz
tar zxvf bash-3.1.tar.gz
cd bash-3.1
 
# get the gpg keyring for verification
wget -nv ftp://ftp.gnu.org/gnu/gnu-keyring.gpg
 
# download and apply all patches, including the latest one that patches CVE-2014-6271
for i in $(seq -f "%03g" 1 23); do
 
  wget -nv https://ftp.gnu.org/gnu/bash/bash-3.1-patches/bash31-$i
  wget -nv https://ftp.gnu.org/gnu/bash/bash-3.1-patches/bash31-$i.sig
 
# removed sig verification because it didn't work
  patch -p0 < bash31-$i
  
done
 
# compile and install to /usr/local/bin/bash
./configure && make
sudo make install
 
# point /bin/bash to the new binary
sudo mv /bin/bash /bin/bash.old
sudo ln -s /usr/local/bin/bash /bin/bash
 
# test by comparing the output of the following
env x='() { :;}; echo vulnerable' /bin/bash.old -c echo
env x='() { :;}; echo vulnerable' bash -c echo