5 ms·

OK two questions: 1. Does zsh (or other shells) also have these kind of string processings where bugs are likely? 2. Is there a way to completely remove bash

by songgao 12y ago

OK two questions: 1. Does zsh (or other shells) also have these kind of string processings where bugs are likely? 2. Is there a way to completely remove bash from the system and use zsh (or other shells) instead?

stock_toaster 12y ago
It really depends on the *nix you are running. FreeBSD, for example, only had bash as a port and it is not in the base install -- I believe `/bin/sh` is a derivative of ash[1]. [1]: http://en.wikipedia.org/wiki/Almquist_shell http://en.wikipedia.org/wiki/Almquist_shell
- arh68 12y ago
  I never really considered the importance of that. It always seemed like some weird crotchety UNIX thing to default to /bin/sh, and usually my first 30 minutes on a FreeBSD box are portsnapping, cd /usr/ports/shells/bash, and a make install clean. Now I get it
  - ZoFreX 12y ago
    The other reason is that bash has dependencies outside the core system and is therefore possible to totally break on FreeBSD. Never change root's shell to bash!
- _delirium 12y ago
  Debian also has a minimalist /bin/sh (via dash), but unlike FreeBSD they do ship bash in the base install, as the default interactive shell. Which is the default interactive shell doesn't matter much, since interactive shell usage isn't the likely vector of this exploit. However some Debian packages may explicitly call bash (rather than /bin/sh), since they can assume it's in the base install, while we know for sure no base FreeBSD packages do. I'm not sure whether anyone's done a survey yet of which Debian packages shell out to bash vs. dash vs. nothing.
  - stock_toaster 12y ago
    I think Android uses mksh[1] these days too. [1]: http://www.all-things-android.com/content/mirbsd-korn-shell-android-shell http://www.all-things-android.com/content/mirbsd-korn-shell-...
eropple 12y ago
1. This exact bug, I dunno? From what I know about zsh, no, but what I don't know about zsh can fill books. But general string bugs? Probably. String processing is hard. 2. Possible yes, practical no (for most folks). Almost everybody's got a bunch of scripts with `#! /bin/bash` or `#! /usr/bin/env bash` lying around. Good luck excising everything that automatically assumes it's the shell of choice.
- Hytosys 12y ago
  `ln -s /bin/zsh /bin/bash`?
  - LeoPanthera 12y ago
    Which would instantly break any script which uses bashisms.
opk 12y ago
All software with more than a few lines of code contains bugs. Zsh doesn't support the misfeature of exported functions so is not vulnerable to this issue.

by songgao 12y ago

stock_toaster 12y ago

It really depends on the *nix you are running. FreeBSD, for example, only had bash as a port and it is not in the base install -- I believe `/bin/sh` is a derivative of ash[1]. [1]: http://en.wikipedia.org/wiki/Almquist_shell http://en.wikipedia.org/wiki/Almquist_shell

arh68 12y ago
I never really considered the importance of that. It always seemed like some weird crotchety UNIX thing to default to /bin/sh, and usually my first 30 minutes on a FreeBSD box are portsnapping, cd /usr/ports/shells/bash, and a make install clean. Now I get it
- ZoFreX 12y ago
  The other reason is that bash has dependencies outside the core system and is therefore possible to totally break on FreeBSD. Never change root's shell to bash!
_delirium 12y ago
Debian also has a minimalist /bin/sh (via dash), but unlike FreeBSD they do ship bash in the base install, as the default interactive shell. Which is the default interactive shell doesn't matter much, since interactive shell usage isn't the likely vector of this exploit. However some Debian packages may explicitly call bash (rather than /bin/sh), since they can assume it's in the base install, while we know for sure no base FreeBSD packages do. I'm not sure whether anyone's done a survey yet of which Debian packages shell out to bash vs. dash vs. nothing.
- stock_toaster 12y ago
  I think Android uses mksh[1] these days too. [1]: http://www.all-things-android.com/content/mirbsd-korn-shell-android-shell http://www.all-things-android.com/content/mirbsd-korn-shell-...

eropple 12y ago

1. This exact bug, I dunno? From what I know about zsh, no, but what I don't know about zsh can fill books. But general string bugs? Probably. String processing is hard. 2. Possible yes, practical no (for most folks). Almost everybody's got a bunch of scripts with `#! /bin/bash` or `#! /usr/bin/env bash` lying around. Good luck excising everything that automatically assumes it's the shell of choice.

Hytosys 12y ago
`ln -s /bin/zsh /bin/bash`?
- LeoPanthera 12y ago
  Which would instantly break any script which uses bashisms.

opk 12y ago

All software with more than a few lines of code contains bugs. Zsh doesn't support the misfeature of exported functions so is not vulnerable to this issue.