3 ms·

I'm a bit confused about how to properly patch my mac. Homebrew installs upgraded bash to /usr/local/bin/bash, everyone says what I should do is run 'chsh -s /

by MBlume 12y ago

I'm a bit confused about how to properly patch my mac. Homebrew installs upgraded bash to /usr/local/bin/bash, everyone says what I should do is run 'chsh -s /usr/local/bin/bash' but if I have a script that has a /bin/bash hashbang at the top, won't it still use the vulnerable bash install? I mean I guess the answer is "you're probably not hosting a publicly accessible service on your mac, who cares?", which is true in my case, but still.

acdha 12y ago
You're correct – you'd need to overwrite /bin/bash (think long and hard about this) to update it before Apple ships an update. The good news is that as long as you're not running a local server, the vulnerability is pretty limited particularly since even if you did have SSH enabled the exploit would require valid authentication first.
- legulere 12y ago
  At least on linux that's not true as NetworkManager + dhclient is affected through malicious dhcp packets. There could be attack vectors almost everywhere.
  - acdha 12y ago
    Oh, certainly. I was only talking about OS X, which didn't build the DHCP client around a collection of shell scripts for portability. On OS X, you could see every time a process is invoked like this: sudo execsnoop -c bash On Linux, that requires work which fortunately Brendan Gregg already did: https://github.com/brendangregg/perf-tools/blob/master/execsnoop https://github.com/brendangregg/perf-tools/blob/master/execs...
- sehugg 12y ago
  There's some potentially funky stuff there like CUPS, which runs a local daemon that serves binary CGIs (though I think it's bound to localhost by default). http://support.apple.com/kb/HT4169 http://support.apple.com/kb/HT4169 Might be wise to turn all network-listening services off that you don't immediately need until a fix is available.
  - acdha 12y ago
    > Might be wise to turn all network-listening services off that you don't immediately need until a fix is available. I would go further and suggest that now is an excellent time to ask which of those services you really need to have at all. The default of blocking incoming connections is right for most people, even developers.
mzs 12y ago
http://ftp.gnu.org/pub/gnu/bash/bash-3.2-patches/bash32-052 http://ftp.gnu.org/pub/gnu/bash/bash-3.2-patches/bash32-052 http://www.opensource.apple.com/source/bash/ http://www.opensource.apple.com/source/bash/
xeroxmalf 12y ago
You could move /bin/bash to another location, and then create a symlink from the Homebrew version to /bin/bash.

by MBlume 12y ago

acdha 12y ago

You're correct – you'd need to overwrite /bin/bash (think long and hard about this) to update it before Apple ships an update. The good news is that as long as you're not running a local server, the vulnerability is pretty limited particularly since even if you did have SSH enabled the exploit would require valid authentication first.

legulere 12y ago
At least on linux that's not true as NetworkManager + dhclient is affected through malicious dhcp packets. There could be attack vectors almost everywhere.
- acdha 12y ago
  Oh, certainly. I was only talking about OS X, which didn't build the DHCP client around a collection of shell scripts for portability. On OS X, you could see every time a process is invoked like this: sudo execsnoop -c bash On Linux, that requires work which fortunately Brendan Gregg already did: https://github.com/brendangregg/perf-tools/blob/master/execsnoop https://github.com/brendangregg/perf-tools/blob/master/execs...
sehugg 12y ago
There's some potentially funky stuff there like CUPS, which runs a local daemon that serves binary CGIs (though I think it's bound to localhost by default). http://support.apple.com/kb/HT4169 http://support.apple.com/kb/HT4169 Might be wise to turn all network-listening services off that you don't immediately need until a fix is available.
- acdha 12y ago
  > Might be wise to turn all network-listening services off that you don't immediately need until a fix is available. I would go further and suggest that now is an excellent time to ask which of those services you really need to have at all. The default of blocking incoming connections is right for most people, even developers.

mzs 12y ago

http://ftp.gnu.org/pub/gnu/bash/bash-3.2-patches/bash32-052 http://ftp.gnu.org/pub/gnu/bash/bash-3.2-patches/bash32-052 http://www.opensource.apple.com/source/bash/ http://www.opensource.apple.com/source/bash/

xeroxmalf 12y ago

You could move /bin/bash to another location, and then create a symlink from the Homebrew version to /bin/bash.