4 ms·
Since other people are reporting that their copies of bash 3.2.51 are vulnerable, I suspect that the version of bash that is currently running in that terminal
by Crito 12y ago
Since other people are reporting that their copies of bash 3.2.51 are vulnerable, I suspect that the version of bash that is currently running in that terminal is 3.2.51 and vulnerable, but the version of bash that you are invoking from that vulnerable version of bash is not.
In other words, I suspect that:
$ echo $BASH_VERSION
and
$ bash --version
Will report different version numbers.
If you start a new terminal and try `echo $BASH_VERSION`, you will probably see a different version as well.
- daveloyall 12y agoExcellent insight!
- ak217 12y agoYes - the shell currently running is probably the user's login shell, and the shell in e.g. /usr/local/bin/bash was probably installed by Homebrew or MacPorts.
- super_mario 12y agoThat could be the reason. I have renamed /bin/bash version 3.2 to /bin/bash3 and copied /usr/local/bin/bash that I build myself to /bin/bash making effectively bash version 4.3 the default login and system shell. I started bash 3.2 from bash 4.3 so that could be the reason why it is not vulnerable as child process.