3 ms·

Can anyone explain what I should do on OSX? I've heard that replacing /bin/bash with a newer version of bash from homebrew or even zsh will work but is that go

Can anyone explain what I should do on OSX? I've heard that replacing /bin/bash with a newer version of bash from homebrew or even zsh will work but is that going to break anything that assumes 3.2 bash??

DSingularity 12y ago
Are you running an HTTP or SSH server that faces the public? If so you need to update or take mitigation steps ASAP. If not you can wait until apple patches.
- petejansson 12y ago
  I'm reluctant to add to uncertainty, but I'm not sure these are the only concerns. Many Linux systems execute shell scripts via bash after acquiring a DCHP address, and would be vulnerable if someone took over the DHCP servers in, say, a co-working space, cafe or airport and maliciously configured them. I'm not 100% sure if Mac OS X (or iOS) use shell scripts for post-assignment configuration. The short answer is to be careful about wireless access you don't control until Apple issues a patch.
  - userbinator 12y ago
    Wait, what? I know DHCP clients have had exploits but those were of the more mundane buffer overflows/range checking type; there are DHCP clients implemented in bash? Something doesn't seem right about that - AFAIK DHCP data like IPs and so forth are binary, not text. Edit: just saw https://news.ycombinator.com/item?id=8367086 https://news.ycombinator.com/item?id=8367086 - may look into that a little more.
quarterto 12y ago
You can apply the patch to the OS X version of 3.2: http://apple.stackexchange.com/questions/146849/how-do-i-recompile-bash-to-avoid-the-remote-exploit-cve-2014-6271-and-cve-2014-7/146851#146851 http://apple.stackexchange.com/questions/146849/how-do-i-rec...
jpitz 12y ago
I've been running upgraded bash - and more recently, just zsh, in OSX for years. It has never broken anything here. I think the risk of breaking something is outweighed by the risk of exploit.
- justincormack 12y ago
  have you pointed /bin/sh and /bin/bash at it?

DSingularity 12y ago

Are you running an HTTP or SSH server that faces the public? If so you need to update or take mitigation steps ASAP. If not you can wait until apple patches.

petejansson 12y ago
I'm reluctant to add to uncertainty, but I'm not sure these are the only concerns. Many Linux systems execute shell scripts via bash after acquiring a DCHP address, and would be vulnerable if someone took over the DHCP servers in, say, a co-working space, cafe or airport and maliciously configured them. I'm not 100% sure if Mac OS X (or iOS) use shell scripts for post-assignment configuration. The short answer is to be careful about wireless access you don't control until Apple issues a patch.
- userbinator 12y ago
  Wait, what? I know DHCP clients have had exploits but those were of the more mundane buffer overflows/range checking type; there are DHCP clients implemented in bash? Something doesn't seem right about that - AFAIK DHCP data like IPs and so forth are binary, not text. Edit: just saw https://news.ycombinator.com/item?id=8367086 https://news.ycombinator.com/item?id=8367086 - may look into that a little more.

quarterto 12y ago

You can apply the patch to the OS X version of 3.2: http://apple.stackexchange.com/questions/146849/how-do-i-recompile-bash-to-avoid-the-remote-exploit-cve-2014-6271-and-cve-2014-7/146851#146851 http://apple.stackexchange.com/questions/146849/how-do-i-rec...

jpitz 12y ago

I've been running upgraded bash - and more recently, just zsh, in OSX for years. It has never broken anything here. I think the risk of breaking something is outweighed by the risk of exploit.

justincormack 12y ago
have you pointed /bin/sh and /bin/bash at it?