3 ms·

Maybe I'm not doing things right, however, when I run the test code for shellshock my 10.9.4 box seems immune. Maybe it's homebrew patching it...

• wmil 12y ago
  My 10.9.5 box fails the tests. What does /bin/sh --version give you?
  • fleitz 12y ago
    $ /bin/bash --version GNU bash, version 3.2.51(1)-release (x86_64-apple-darwin13) Copyright (C) 2007 Free Software Foundation, Inc.
    • m3mnoch 12y ago
      try this then: $ env X="() { :;} ; echo busted" /bin/bash -c "echo wow" that'll pop out of usr, so you'll fail.
      • fleitz 12y ago
        Yup, definitely busted.
• Doji 12y ago
  It's definitely homebrew, Apple hasn't patched their binaries. Don't let this give you to a false sense of security. Many scripts could still be hardcoded to use your vulnerable /bin/bash binary, and many more won't load the PATH variable from your ~/.bash_profile. The only way to fix the problem is to patch /bin/bash and /bin/sh, updating homebrew is not nearly enough.
• D4AHNGM 12y ago
  Homebrew has patched Bash for all 3 recently announced vulnerabilities, yes. The vulnerable bash will still be lurking on your system though, in /bin/bash and /bin/sh.