3 ms·

For Mac OS X, until Apple releases a software update, I've applied the original CVE-2014-6271 (shellshock) patch and am going to apply the CVE-2014-7169 patch a

• rsync 12y ago
  why not simply chmod 0000 `which bash` ?
  • Zancarius 12y ago
    The problem is that some utilities rely heavily on bashisms such that they're unlikely to work with dash or other POSIX-compliant sh-replacements. As an Arch user, just off the top of my head, I can think of yaourt (AUR helper) and apparently the shell script for invoking gradle as both reliant on such behavior. The latter may not affect everyone, and after running into just those two samples today, I can only imagine what else may be affected. The best solution I could think of as a work around is to install dash, replace the /bin/sh symlink pointing to dash, and then chown/chmod bash so that only those specific users who need to use it can use it. This isn't perfect, because it could still be affected by web services that run as users that would then have access to bash via their member group(s), or because a web service might rely on another application that itself requires specific bashisms in order to function. This is why abandoning correctness for convenience can be dangerous.
  • sjy 12y ago
    This isn't really enough because /bin/sh is also a copy of bash (not a symlink).
• idorosen 12y ago
  I've updated this to the latest patch which covers CVE-2014-7169.