3 ms·
Interestingly enough ancient BASH version 3.2 on Mac OS X 10.9.5 is not vulnerable: $ echo $BASH_VERSION 3.2.51(1)-release $ x='() { :;}; echo vuln
by super_mario 12y ago
Interestingly enough ancient BASH version 3.2 on Mac OS X 10.9.5 is not vulnerable:
$ echo $BASH_VERSION
3.2.51(1)-release
$ x='() { :;}; echo vulnerable' bash -c "echo this is a test"
bash: warning: x: ignoring function definition attempt
bash: error importing function definition for `x'
this is a test
$
I manually patched my BASH 4.3 to patch level 25 so it's not vulnerable either.
$ echo $BASH_VERSION
4.3.25(1)-release
$ x='() { :;}; echo vulnerable' bash -c "echo this is a test"
bash: warning: x: ignoring function definition attempt
bash: error importing function definition for `x'
this is a test
$
- daveloyall 12y agoThat's ... weird, since the phrase "ignoring function definition attempt" wasn't added to bash 3.2 until today, with patch level 52. http://ftp.gnu.org/pub/gnu/bash/bash-3.2-patches/bash32-052 http://ftp.gnu.org/pub/gnu/bash/bash-3.2-patches/bash32-052 Your paste indicates patch level 51. The phrase in question doesn't appear on the internet much at all before today. https://www.google.com/search?q="ignoring+function+definition+attempt"&tbs=cdr%3A1%2Ccd_min%3A%2Ccd_max%3A9%2F23%2F2014 https://www.google.com/search?q="ignoring+function+definitio... I presume that the one search result we see is due to a server that has an incorrect clock (or a time machine).
- Fishkins 12y agoHmm, I do see "vulnerable" print when I run that code on Mac OS X 10.9.5 with bash 3.2.51(1)-release.
- Crito 12y agoSince other people are reporting that their copies of bash 3.2.51 are vulnerable, I suspect that the version of bash that is currently running in that terminal is 3.2.51 and vulnerable, but the version of bash that you are invoking from that vulnerable version of bash is not. In other words, I suspect that: $ echo $BASH_VERSION and $ bash --version Will report different version numbers. If you start a new terminal and try `echo $BASH_VERSION`, you will probably see a different version as well.
- daveloyall 12y agoExcellent insight!
- ak217 12y agoYes - the shell currently running is probably the user's login shell, and the shell in e.g. /usr/local/bin/bash was probably installed by Homebrew or MacPorts.
- super_mario 12y agoThat could be the reason. I have renamed /bin/bash version 3.2 to /bin/bash3 and copied /usr/local/bin/bash that I build myself to /bin/bash making effectively bash version 4.3 the default login and system shell. I started bash 3.2 from bash 4.3 so that could be the reason why it is not vulnerable as child process.
- aabdocker 12y agoI have same bash version and yet mine is vulnerable on OS X 10.10.