3 ms·

I see this in zsh 5.0.0 on Ubuntu, and on OSX as well! zsh 5.0.2 (x86_64-apple-darwin13.0)

• Crito 12y ago
  I'm not seeing this on zsh 4.3.17. Exactly what did you run to see this?
  • pja 12y ago
    They probably ran env x='() { :;}; echo vulnerable' bash -c "echo this is a test" but failed to spot that the second command invokes bash not zsh. My tests suggest that neither zsh 4.3.17 or 5.0.6 (the versions that ship with Debian stable & testing respectively) are vulnerable to this exploit - if you replace bash with zsh in the test oneliner then the code after the end of the function definition in the environment variable is not executed.
    • flexd 12y ago
      That's it, I am an idiot today. (and more days probably)