Whonix 9.1 Maintenance Release - Testers wanted!

[Patrick]

[html]

Download:

http://mirror.whonix.de/9.1/

Changelog between 9 and 9.1:

– updated frozen sources (contains apt-get and bash security fixes)

– anon-gw-anonymizer-config: Fixed startup of Tor due to an AppArmor conflict as per bug reports in the forums https://www.whonix.org/forum/index.php/topic,559.0.html. Needed to out commented “/usr/bin/obfsproxy rix,” in file “/etc/apparmor.d/local/system_tor.anondist” because The Tor Project added “/usr/bin/obfsproxy PUx,” to file “/etc/apparmor.d/abstractions/tor”. Therefore users of obfsproxy will now end up running obfsproxy unconfined, because we would now require a standalone obfsproxy AppArmor profile. Note, that this is not a Whonix specific issue. Also if you were using plain Debian, no one redistributes an obfsproxy AppArmor profile at time of writing.

[/html]

[HulaHoop]

Besides the small problems mentioned in the other thread, all if fine here. Whonix News is giving me a confusing message however about version 9.1 being outdated and that I need to manually download a newer one because auto-updates don’t work.

[ir1s]

Please keep in mind that the ‘ShellShock’ isn’t completely fixed at time of writing.

Bash specially-crafted environment variables code injection attack - Red Hat...

Tavis Ormandy (taviso)

[Patrick]

Whonix News is giving me a confusing message however about version 9.1 being outdated and that I need to manually download a newer one because auto-updates don’t work.

Fixed that by updating Whonix News.

[Patrick]

Besides the small problems mentioned in the other thread,

Rerference:
https://www.whonix.org/forum/index.php/topic,531.msg4383.html#msg4383

[quote=“ir1s, post:3, topic:543”]Please keep in mind that the ‘ShellShock’ isn’t completely fixed at time of writing.

https://securityblog.redhat.com/2014/09/24/bash-specially-crafted-environment-variables-code-injection-attack/

https://twitter.com/taviso/status/514887394294652929[/quote]
Nothing we can do about this at the moment. Not fixed in Debian yet.
Also see:
https://www.whonix.org/forum/index.php/topic,568.0.html

[ir1s]

[quote=“Patrick, post:5, topic:543”]Nothing we can do about this at the moment. Not fixed in Debian yet.
Also see:
https://www.whonix.org/forum/index.php/topic,568.0.html[/quote]

It’s now fixed within 4.2+dfsg-0.1+deb7u3. I have posted this, because i think it would be good to have a fix for this major bug within the upcoming maintenance release.

[Patrick]

[quote=“ir1s, post:6, topic:543”][quote author=Patrick link=topic=570.msg4394#msg4394 date=1411670192]
Nothing we can do about this at the moment. Not fixed in Debian yet.
Also see:
https://www.whonix.org/forum/index.php/topic,568.0.html
[/quote]

It’s now fixed within 4.2+dfsg-0.1+deb7u3. I have posted this, because i think it would be good to have a fix for this major bug within the upcoming maintenance release. ;)[/quote]

That will happen in Whonix 9.2.