13 ms·

OS X Bash Update 1.0

247 points by 0x0 12y ago

tehwalrus 12y ago
System Requirements OS X Mavericks v10.9.5 or later so, they're not updating older machines? My partner still runs Snow Leopard 10.6.8!
- amatheus 12y ago
  Links for: Mountain Lion http://support.apple.com/kb/DL1768 http://support.apple.com/kb/DL1768 Lion http://support.apple.com/kb/DL1767 http://support.apple.com/kb/DL1767 Source: http://www.512pixels.net/blog/2014/9/apple-posts-bash-updates http://www.512pixels.net/blog/2014/9/apple-posts-bash-update...
  - tehwalrus 12y ago
    Thanks for the clarification. Still a shame I'll have to install XCode on her machine to get a newer version of bash compiled and installed...
- mattyohe 12y ago
  Looks like 10.6 isn't supported, but there are older versions supported: 10.7: http://support.apple.com/kb/DL1767 http://support.apple.com/kb/DL1767 10.8: http://support.apple.com/kb/DL1768 http://support.apple.com/kb/DL1768
- jcurbo 12y ago
  Looks like 10.6 hasn't been updated in a while. http://arstechnica.com/apple/2014/03/snow-leopard-updates-are-probably-done-here-are-your-os-x-upgrade-options/ http://arstechnica.com/apple/2014/03/snow-leopard-updates-ar... With Apple stuff it seems like it's best to stay within 2 revisions of the latest OS, especially since they've moved to shorter release cycles (yearly).
  - tehwalrus 12y ago
    Thanks, I'll work out what to do instead, then. Problem is she won't sit through lessons about what multi-touch gestures to use to find that chrome popup window that disappeared or whatever, I would be loath to help her navigate something like the UI updates in Lion, let alone beyond. If only Alt+Tab worked on windows rather than apps, like in MS OSs, or even if there was a taskbar-style way to switch windows, she'd have so many fewer problems...
    - thenipper 12y ago
      Check out witch? It helps with alt-tab
    - nsxwolf 12y ago
      Can't teach her Alt+Tilde? (er, Alt-Backtick really)
    - Angostura 12y ago
      Multitouch guestures aren't mandatory, good old mouse and click will work just as they always have. CMD-~ cycles through windows. hold-click or right-click on a Dock icon displays a list of Windows associated with the application Alternatvely, perhaps she might like Exposé (try F3)
    - deleted 12y ago
      [deleted]
    - terhechte 12y ago
      >> .. taskbar-style way to switch windows http://brawersoftware.com/products/ubar http://brawersoftware.com/products/ubar Apart from that, even on 10.6, you can do the update of Bash yourself, you're not required to use the Apple patch: https://github.com/ido/macosx-bash-92-shellshock-patched https://github.com/ido/macosx-bash-92-shellshock-patched This has been compiled on Mavericks, it may run on 10.6. If not, you may need to install Xcode
    - jbinto 12y ago
      > [..] multi-touch gestures to use to find that chrome popup window that disappeared [..] This may not help for your case, but it may interest keyboard shortcut junkies. When I was getting used to the "interesting" way OS X handles CMD+TAB versus Windows' ALT+TAB, I was also frustrated at the app-vs-window issue. I eventually figured out this workaround, which sounds complicated but is now muscle memory: 1. Hold CMD. (Don't let go until I say so.) 2. Press TAB once. 3. Tap the arrow keys (LEFT/RIGHT) to go to the correct application, e.g. Chrome. 4. When you have the correct application selected, press DOWN. (You can release CMD now.) 5. This will display all of the open windows for this application (same as "4 finger swipe down" gesture). You can use the arrow keys to navigate this. An extremely subtle blue halo is displayed around the selected window. Press RETURN to select.
- tehwalrus 12y ago
  ...downvote a bit unfair, surely, the patch is trivial to release for all versions (since Bash hasn't been updated across them, IIRC).
  - scintill76 12y ago
    Apparently you must be punished for daring to let your partner use something that's still perfectly functional for many uses, when Apple has something newer! Maybe they're saying you should upgrade for security reasons, but it'd be nice if they actually said it. Seriously, I'm failing to understand the amount of downvote-hate being focused on you right now, in every comment you gave in this thread. Sorry.
    - kps 12y ago
      > something that's still perfectly functional More functional, sometimes; I have 10.6.8 on my home Mac Pro because 10.7 removed a vital feature.
  - mwfunk 12y ago
    I'm pretty sure they're not doing security updates in general for Snow Leopard anymore, so if you're concerned about security then that should be a much more worrisome to you than the fact that there's no bash fix. http://arstechnica.com/apple/2014/03/snow-leopard-updates-are-probably-done-here-are-your-os-x-upgrade-options/ http://arstechnica.com/apple/2014/03/snow-leopard-updates-ar...
thebiglebrewski 12y ago
Wait, so can anyone tell me what the risk is if you don't apply this update?
- gnarbarian 12y ago
  Unauthorized remote code execution. ... so pretty much worst case scenario
- deleted 12y ago
  [deleted]
- mikeryan 12y ago
  Its the Shellshock security vulnerability. http://www.pcworld.com/article/2688672/two-scenarios-that-would-make-os-x-vulnerable-to-the-shellshock-bug.html http://www.pcworld.com/article/2688672/two-scenarios-that-wo...
- k_roy 12y ago
  I may be wrong here, but I'm pretty sure as long as you aren't running any network services, you are probably ok. This is a big deal because it's remotely exploitable. But it's only exploitable remotely if you are running a network daemon that somehow invokes bash and sets environment variables without sanitization. Web sharing, SSH in some instances, a few MTAs. The average user PROBABLY isn't running a daemon that is vulnerable. Though in some cases, you may be and not know it (like if you had turned on Web Sharing at some point) All of this is not to say that if you can apply the patch, do it.
  - tonteldoos 12y ago
    Yes and no. Bash gets used in many, often invisible, ways. Even a piece of compromised software run locally, or a web service accessing local data may present a problem. Admittedly this is a remote chance (and not in the wild afaik), but better safe than sorry. Patch took all of a minute to install. Let's hope it's actually a complete fix.
    - 12y ago
0x0 12y ago
Also for 10.8: http://support.apple.com/kb/DL1768 http://support.apple.com/kb/DL1768 And for 10.7: http://support.apple.com/kb/DL1767 http://support.apple.com/kb/DL1767 Edit: Further information from the announcement is available here: http://lists.apple.com/archives/security-announce/2014/Sep/msg00001.html http://lists.apple.com/archives/security-announce/2014/Sep/m...
deleted 12y ago
[deleted]
dewey 12y ago
Is there a reason why this is not coming via the regular software update? I don't think a lot of people are watching Apple's support pages for updates.
- pudquick 12y ago
  This information was released in an Apple mailing list: http://lists.apple.com/archives/security-announce/2014/Sep/msg00001.html http://lists.apple.com/archives/security-announce/2014/Sep/m... The direct download pages are published first. It should be showing up on the update servers shortly.
  - acdha 12y ago
    It's still currently not showing up 16 hours later. I'm starting to wonder whether they're working on an updated version using one of the improved patches.
- jdnier 12y ago
  It also seems positively weird that Apple's support pages and this security update aren't delivered via https.
  - MagerValp 12y ago
    The update package itself is signed.
- adrianN 12y ago
  It is coming with the regular update for me.
  - dewey 12y ago
    Yea, it took a few hours to show up there. Wasn't showing up when the patch was released.
    - 12y ago
Zarel 12y ago
There appear to be updates for 10.9, 10.8, and 10.7, but I can't seem to find one for 10.10 (and yes, 10.10 beta 3 is vulnerable). I guess us Yosemite users will have to wait for the next beta...
kazazes 12y ago
Disconcertingly, this doesn't show up in Software Update on my machine running 10.10, but that may be because I'm on the beta. Is this being pushed to the App Store/Software Update for OS' < 10.10? (For those wondering, the 10.9 installer does not run on 10.10)
- pflats 12y ago
  Are you running a public-facing Apache server on the beta? I wouldn't call it disconcerting that they're focusing their resources on released versions of OS X. I'd rather they cover the other CVEs sooner and ship 10.10.0 with no issues[1] when it's done than divert engineering resources to ship a patch for Yosemite. [1] bash-related issues, at least. Apple's .0 track record speaks for itself.
- sigzero 12y ago
  10.10 isn't out yet. It's BETA. So that is a reasonable expectation.
tonteldoos 12y ago
Any reason this is not showing up in the App Store Updates page? (sorry, I'm still getting my head around OS X...)
- deleted 12y ago
  [deleted]
- aspHax0 12y ago
  It'll take some time before it shows up, but it should eventually (hopefully by tonight or tomorrow morning).
- deleted 12y ago
  [deleted]
bullfight 12y ago
Just a heads up this page and the url download are over http, the https pages are totally broken. https://support.apple.com/kb/HT1222 https://support.apple.com/kb/HT1222
- X-Istence 12y ago
  The .pkg is signed, otherwise it won't run (unless you have disabled that feature, in which case you are driving around without seatbelts anyway)
Titanous 12y ago
With the update installed: $ curl -s https://raw.githubusercontent.com/hannob/bashcheck/master/bashcheck | bash Not vulnerable to CVE-2014-6271 (original shellshock) Not vulnerable to CVE-2014-7169 (taviso bug) bash: line 18: 14885 Segmentation fault: 11 bash -c "true $(printf '<<EOF %.0s' {1..79})" 2> /dev/null Vulnerable to CVE-2014-7186 (redir_stack bug) Test for CVE-2014-7187 not reliable without address sanitizer Variable function parser inactive, likely safe from unknown parser bugs
- gphil 12y ago
  I just reproduced this on 10.9.5 as well.
- deleted 12y ago
  [deleted]
- ten7 12y ago
  Also reproduced on 10.9.5 -- you would think that there's sometone at Apple looking at this forum and at hannob's bashcheck and that it would get tested. I guess there will be a 1.1 version of the update soon?
- scintill76 12y ago
  "Variable function parser inactive" -- interesting, did they apply the unofficial patch to namespace-prefix function definitions? This poster[0] seems to not have it, though. Who is right? The test at that github link seems a bit sketchy, by using a simple name like "a" instead of, say, __test_bashbug_a, and not checking the output very thoroughly. But it seems like it would fail the other way if there's a command named "a" in OS X's PATH... https://news.ycombinator.com/item?id=8385819 https://news.ycombinator.com/item?id=8385819
  - mcpherrinm 12y ago
    It isn't unoffical anymore. For bash3.2, which seems to be what apple is distributing, that patch is ftp://ftp.gnu.org/pub/gnu/bash/bash-3.2-patches/bash32-054
porsupah 12y ago
For anyone curious, the package installer will refuse to run on Yosemite, declaring it requires OS X 10.9. (Of peripheral interest, whilst checking in the iOS Dev Center, I noticed there's a beta of iOS 8.1)
- xyclos 12y ago
  yeah, despite the statement: "OS X Mavericks v10.9.5 or later"
  - mitchty 12y ago
    Probably only applies to released versions of OS X. Apple treats beta a bit differently than I think many expect. It is a bit closer to the old school definition.
    - orbitur 12y ago
      Highly likely. I don't see why Apple would "patch" something that's not out yet. Since we didn't see another DP this week, I'm assuming the Bash update will appear in the RC... hopefully that's out soon.
      - mitchty 12y ago
        Yep, and if you're really hard up to get it into 10.10. Just extract the relevant binaries from the 10.9 version. Though a better question would be what the hell are you doing with 10.10 that you need to. OS X betas are very much beta. https://gist.github.com/mitchty/6e835bb51735099b6eba https://gist.github.com/mitchty/6e835bb51735099b6eba
vectorsize 12y ago
no https? no checksums?
- aroch 12y ago
  All of Apple's OS updaters are signed by Apple's internal CA and verified at install time -- that's why there's no checksum: http://idzr.org/ba4o http://idzr.org/ba4o
pudquick 12y ago
Do note: This addresses CVE-2014-6271 and CVE-2014-7169 only. There are currently 6 CVEs listed on the Wikipedia page (not sure which are accurate): http://en.wikipedia.org/wiki/Shellshock_%28software_bug%29#Subsequent_reports http://en.wikipedia.org/wiki/Shellshock_%28software_bug%29#S... Some protection is better than none and I'm glad to see Apple rapidly responding. But this doesn't fix all the issues known to exist currently.
- simme_ 12y ago
  > I'm glad to see Apple rapidly responding It seems we have different expectations concerning the term rapid...
  - pudquick 12y ago
    Disclosure was on the 24th, today is the 29th. The patch had to be developed in-between (released on the 26th I think?). 3-5 days is pretty decent considering that the DHCP stack on OS X isn't vulnerable and only customers that had enabled the apache2 instance and configured it with non-default mods were possibly affected. More often than not Apple is removing GPL code from OS X altogether in the face of issues (example: samba is now replaced with 'smbx' in-house implementation). I felt it was 50/50 that they'd update it vs. remove/disable it.
    - eridius 12y ago
      Kind of hard to remove Bash when it's the default shell and a great many scripts have been written targeting Bash features. Sure, there are other sh-compatible shells, but AFAIK they aren't 100% compatible with Bash. Edit: If you disagree with me, please reply instead of downvoting.
      - deleted 12y ago
        [deleted]
      - dangerlibrary 12y ago
        Let's hope they aren't 100% compatible!
auvi 12y ago
Before: $ bash --version GNU bash, version 3.2.51(1)-release (x86_64-apple-darwin13) After: $ bash --version GNU bash, version 4.3.26(1)-release (x86_64-apple-darwin13.4.0)
- goalieca 12y ago
  Huh? I didn't get that at all. Are you running ports maybe?? $ bash --version GNU bash, version 3.2.51(1)-release (x86_64-apple-darwin13) Copyright (C) 2007 Free Software Foundation, Inc. $ bash --version GNU bash, version 3.2.53(1)-release (x86_64-apple-darwin13) Copyright (C) 2007 Free Software Foundation, Inc.
- Igglyboo 12y ago
  There's no way they're pushing out a GPLv3 version of bash, you sure you didn't confuse it with a brew/macports installed version?
  - sigjuice 12y ago
    From Apple's email announcement http://lists.apple.com/archives/security-announce/2014/Sep/msg00001.html http://lists.apple.com/archives/security-announce/2014/Sep/m... * The version after applying this update will be: OS X Mavericks: GNU bash, version 3.2.53(1)-release (x86_64-apple-darwin13) OS X Mountain Lion: GNU bash, version 3.2.53(1)-release (x86_64-apple-darwin12) OS X Lion: GNU bash, version 3.2.53(1)-release (x86_64-apple-darwin11)
- deleted 12y ago
  [deleted]
- dmytrish 12y ago
  Indeed, port install bash cat /opt/local/bin/bash >> /etc/shells chsh -s /opt/local/bin/bash mv /bin/bash /bin/bash-apple ln /opt/local/bin/bash /bin/bash solves the problem.
Fastidious 12y ago
"OS X Mavericks v10.9.5 or later" doesn't include Yosemite.
- sigzero 12y ago
  Yosemite isn't out yet except in Beta. So that is understandable really.
  - Fastidious 12y ago
    That doesn't make any sense. Yosemite is on DP and Public beta, yet still vulnerable. One thing has nothing to do with the other.
- Watabou 12y ago
  We will probably get another DP tomorrow as it has been two weeks now since the previous DP
  - orbitur 12y ago
    They updated Xcode and iOS today, no DP. Makes me think we'll see the RC, maybe, hopefully.
BenjiGriff 12y ago
Great! This should fix that lockscreen bug and a few others. But lets keep our fingers crossed now.
mjcohen 12y ago
Worked on my Lion MacBook Pro. Went to the terminal which previously said "vulnerable", redid the command, now ok.
orblivion 12y ago
Anybody know what took them so long?
- yachi 12y ago
  Because they just upgraded to xcode 6.
mkoryak 12y ago
sadly this will update bash on 10.9.5 only. Im on 10.9.3 because the last mac I updated to that version caused it to kernel panic whenever I connected an external monitor. Mavericks is apple's Windows Vista
deleted 12y ago
[deleted]
bluedino 12y ago
What about the handful of 10.5 machines still running?
deleted 12y ago
[deleted]
unspecified 12y ago
Hmph, the other thread fell off the front page, but: There is a handy zsh script (zsh is in /bin on OSX by default) to get the Bash tarball from opensource.apple.com, apply patches 52, 53, and 54 from ftp.gnu.org, build it, and then prompt to replace /bin/bash and /bin/sh. Xcode is required, and you have to run "sudo xcodebuild" once to accept the EULA. https://github.com/tjluoma/bash-fix https://github.com/tjluoma/bash-fix This is the easiest way I've found to patch the system-level /bin/bash AND /bin/sh binaries.
aabdocker 12y ago
No surprise it doesn't work on 10.10.
mythz 12y ago
Website says `OS X Mavericks v10.9.5 or later` but fails to run in Yosemite with the error alert: > This update requires OS X version 10.9.
deleted 12y ago
[deleted]
alblue 12y ago
Note that Apple has not provided updates for older systems. If you have an older system and wish to patch, I have been keeping my blog post [1] updated along with the canonical StackExchange answer [2]. Note that the patch from Apple allows bash functions to be escaped, albeit with a BASH_FUNC prefix - but you can get around this by using: $ env '__BASH_FUNC<ls>()'="() { echo Game Over; }" bash -c ls Game Over [1] http://alblue.bandlem.com/2014/09/bash-remote-vulnerability.html http://alblue.bandlem.com/2014/09/bash-remote-vulnerability.... [2] http://apple.stackexchange.com/questions/146849/ http://apple.stackexchange.com/questions/146849/
- osxrand 12y ago
  Unless you're talking about 10.6 or older : Quoted from 0x0 Also for 10.8: http://support.apple.com/kb/DL1768 http://support.apple.com/kb/DL1768 And for 10.7: http://support.apple.com/kb/DL1767 http://support.apple.com/kb/DL1767 Edit: Further information from the announcement is available here: http://lists.apple.com/archives/security-announce/2014/Sep/m.. http://lists.apple.com/archives/security-announce/2014/Sep/m.... Just posting it here incase someone reads your comment and misses 0x0's
bstream 12y ago
(master) $ echo $BASH_VERSION 4.3.27(1)-release (master) $ ./bashcheck Not vulnerable to CVE-2014-6271 (original shellshock) Not vulnerable to CVE-2014-7169 (taviso bug) ./bashcheck: line 18: 7675 Segmentation fault: 11 bash -c "true $(printf '<<EOF %.0s' {1..79})" 2> /dev/null Vulnerable to CVE-2014-7186 (redir_stack bug) Test for CVE-2014-7187 not reliable without address sanitizer Variable function parser inactive, likely safe from unknown parser bugs It seems as though there is no patch that fixes CVE-2014-7186 yet?
brynmathias 12y ago
Word of warning, if you have chmod 0000 /bin/bash put it back to how you found it before running the update. If you didn't do this: cmd + s to boot in safe mode. /sbin/mount -wu / and chmod bash back to a useable state, if you get stuck at log in.
GeorgeOfTJungle 12y ago
http://hacksagogo.wordpress.com/2014/10/02/shell-shock-os-x-bash-update-installer-for-snow-leopard/ http://hacksagogo.wordpress.com/2014/10/02/shell-shock-os-x-... Here’s for the crazy ones, the misfits, the trouble makers, the round pegs in the square holes. The ones who see things differently... and are still running Snow Leopard.

247 points by 0x0 12y ago

System Requirements OS X Mavericks v10.9.5 or later so, they're not updating older machines? My partner still runs Snow Leopard 10.6.8!

amatheus 12y ago
Links for: Mountain Lion http://support.apple.com/kb/DL1768 http://support.apple.com/kb/DL1768 Lion http://support.apple.com/kb/DL1767 http://support.apple.com/kb/DL1767 Source: http://www.512pixels.net/blog/2014/9/apple-posts-bash-updates http://www.512pixels.net/blog/2014/9/apple-posts-bash-update...
- tehwalrus 12y ago
  Thanks for the clarification. Still a shame I'll have to install XCode on her machine to get a newer version of bash compiled and installed...
mattyohe 12y ago
Looks like 10.6 isn't supported, but there are older versions supported: 10.7: http://support.apple.com/kb/DL1767 http://support.apple.com/kb/DL1767 10.8: http://support.apple.com/kb/DL1768 http://support.apple.com/kb/DL1768
jcurbo 12y ago
Looks like 10.6 hasn't been updated in a while. http://arstechnica.com/apple/2014/03/snow-leopard-updates-are-probably-done-here-are-your-os-x-upgrade-options/ http://arstechnica.com/apple/2014/03/snow-leopard-updates-ar... With Apple stuff it seems like it's best to stay within 2 revisions of the latest OS, especially since they've moved to shorter release cycles (yearly).
- tehwalrus 12y ago
  Thanks, I'll work out what to do instead, then. Problem is she won't sit through lessons about what multi-touch gestures to use to find that chrome popup window that disappeared or whatever, I would be loath to help her navigate something like the UI updates in Lion, let alone beyond. If only Alt+Tab worked on windows rather than apps, like in MS OSs, or even if there was a taskbar-style way to switch windows, she'd have so many fewer problems...
  - thenipper 12y ago
    Check out witch? It helps with alt-tab
  - nsxwolf 12y ago
    Can't teach her Alt+Tilde? (er, Alt-Backtick really)
  - Angostura 12y ago
    Multitouch guestures aren't mandatory, good old mouse and click will work just as they always have. CMD-~ cycles through windows. hold-click or right-click on a Dock icon displays a list of Windows associated with the application Alternatvely, perhaps she might like Exposé (try F3)
  - deleted 12y ago
    [deleted]
  - terhechte 12y ago
    >> .. taskbar-style way to switch windows http://brawersoftware.com/products/ubar http://brawersoftware.com/products/ubar Apart from that, even on 10.6, you can do the update of Bash yourself, you're not required to use the Apple patch: https://github.com/ido/macosx-bash-92-shellshock-patched https://github.com/ido/macosx-bash-92-shellshock-patched This has been compiled on Mavericks, it may run on 10.6. If not, you may need to install Xcode
  - jbinto 12y ago
    > [..] multi-touch gestures to use to find that chrome popup window that disappeared [..] This may not help for your case, but it may interest keyboard shortcut junkies. When I was getting used to the "interesting" way OS X handles CMD+TAB versus Windows' ALT+TAB, I was also frustrated at the app-vs-window issue. I eventually figured out this workaround, which sounds complicated but is now muscle memory: 1. Hold CMD. (Don't let go until I say so.) 2. Press TAB once. 3. Tap the arrow keys (LEFT/RIGHT) to go to the correct application, e.g. Chrome. 4. When you have the correct application selected, press DOWN. (You can release CMD now.) 5. This will display all of the open windows for this application (same as "4 finger swipe down" gesture). You can use the arrow keys to navigate this. An extremely subtle blue halo is displayed around the selected window. Press RETURN to select.
tehwalrus 12y ago
...downvote a bit unfair, surely, the patch is trivial to release for all versions (since Bash hasn't been updated across them, IIRC).
- scintill76 12y ago
  Apparently you must be punished for daring to let your partner use something that's still perfectly functional for many uses, when Apple has something newer! Maybe they're saying you should upgrade for security reasons, but it'd be nice if they actually said it. Seriously, I'm failing to understand the amount of downvote-hate being focused on you right now, in every comment you gave in this thread. Sorry.
  - kps 12y ago
    > something that's still perfectly functional More functional, sometimes; I have 10.6.8 on my home Mac Pro because 10.7 removed a vital feature.
- mwfunk 12y ago
  I'm pretty sure they're not doing security updates in general for Snow Leopard anymore, so if you're concerned about security then that should be a much more worrisome to you than the fact that there's no bash fix. http://arstechnica.com/apple/2014/03/snow-leopard-updates-are-probably-done-here-are-your-os-x-upgrade-options/ http://arstechnica.com/apple/2014/03/snow-leopard-updates-ar...

thebiglebrewski 12y ago

Wait, so can anyone tell me what the risk is if you don't apply this update?

gnarbarian 12y ago
Unauthorized remote code execution. ... so pretty much worst case scenario
deleted 12y ago
[deleted]
mikeryan 12y ago
Its the Shellshock security vulnerability. http://www.pcworld.com/article/2688672/two-scenarios-that-would-make-os-x-vulnerable-to-the-shellshock-bug.html http://www.pcworld.com/article/2688672/two-scenarios-that-wo...
k_roy 12y ago
I may be wrong here, but I'm pretty sure as long as you aren't running any network services, you are probably ok. This is a big deal because it's remotely exploitable. But it's only exploitable remotely if you are running a network daemon that somehow invokes bash and sets environment variables without sanitization. Web sharing, SSH in some instances, a few MTAs. The average user PROBABLY isn't running a daemon that is vulnerable. Though in some cases, you may be and not know it (like if you had turned on Web Sharing at some point) All of this is not to say that if you can apply the patch, do it.
- tonteldoos 12y ago
  Yes and no. Bash gets used in many, often invisible, ways. Even a piece of compromised software run locally, or a web service accessing local data may present a problem. Admittedly this is a remote chance (and not in the wild afaik), but better safe than sorry. Patch took all of a minute to install. Let's hope it's actually a complete fix.
  - 12y ago

0x0 12y ago

Also for 10.8: http://support.apple.com/kb/DL1768 http://support.apple.com/kb/DL1768 And for 10.7: http://support.apple.com/kb/DL1767 http://support.apple.com/kb/DL1767 Edit: Further information from the announcement is available here: http://lists.apple.com/archives/security-announce/2014/Sep/msg00001.html http://lists.apple.com/archives/security-announce/2014/Sep/m...

deleted 12y ago

[deleted]

dewey 12y ago

Is there a reason why this is not coming via the regular software update? I don't think a lot of people are watching Apple's support pages for updates.

pudquick 12y ago
This information was released in an Apple mailing list: http://lists.apple.com/archives/security-announce/2014/Sep/msg00001.html http://lists.apple.com/archives/security-announce/2014/Sep/m... The direct download pages are published first. It should be showing up on the update servers shortly.
- acdha 12y ago
  It's still currently not showing up 16 hours later. I'm starting to wonder whether they're working on an updated version using one of the improved patches.
jdnier 12y ago
It also seems positively weird that Apple's support pages and this security update aren't delivered via https.
- MagerValp 12y ago
  The update package itself is signed.
adrianN 12y ago
It is coming with the regular update for me.
- dewey 12y ago
  Yea, it took a few hours to show up there. Wasn't showing up when the patch was released.
  - 12y ago

Zarel 12y ago

There appear to be updates for 10.9, 10.8, and 10.7, but I can't seem to find one for 10.10 (and yes, 10.10 beta 3 is vulnerable). I guess us Yosemite users will have to wait for the next beta...

kazazes 12y ago

Disconcertingly, this doesn't show up in Software Update on my machine running 10.10, but that may be because I'm on the beta. Is this being pushed to the App Store/Software Update for OS' < 10.10? (For those wondering, the 10.9 installer does not run on 10.10)

pflats 12y ago
Are you running a public-facing Apache server on the beta? I wouldn't call it disconcerting that they're focusing their resources on released versions of OS X. I'd rather they cover the other CVEs sooner and ship 10.10.0 with no issues[1] when it's done than divert engineering resources to ship a patch for Yosemite. [1] bash-related issues, at least. Apple's .0 track record speaks for itself.
sigzero 12y ago
10.10 isn't out yet. It's BETA. So that is a reasonable expectation.

tonteldoos 12y ago

Any reason this is not showing up in the App Store Updates page? (sorry, I'm still getting my head around OS X...)

deleted 12y ago
[deleted]
aspHax0 12y ago
It'll take some time before it shows up, but it should eventually (hopefully by tonight or tomorrow morning).
deleted 12y ago
[deleted]

bullfight 12y ago

Just a heads up this page and the url download are over http, the https pages are totally broken. https://support.apple.com/kb/HT1222 https://support.apple.com/kb/HT1222

X-Istence 12y ago
The .pkg is signed, otherwise it won't run (unless you have disabled that feature, in which case you are driving around without seatbelts anyway)

Titanous 12y ago

With the update installed: $ curl -s https://raw.githubusercontent.com/hannob/bashcheck/master/bashcheck | bash Not vulnerable to CVE-2014-6271 (original shellshock) Not vulnerable to CVE-2014-7169 (taviso bug) bash: line 18: 14885 Segmentation fault: 11 bash -c "true $(printf '<<EOF %.0s' {1..79})" 2> /dev/null Vulnerable to CVE-2014-7186 (redir_stack bug) Test for CVE-2014-7187 not reliable without address sanitizer Variable function parser inactive, likely safe from unknown parser bugs

gphil 12y ago
I just reproduced this on 10.9.5 as well.
deleted 12y ago
[deleted]
ten7 12y ago
Also reproduced on 10.9.5 -- you would think that there's sometone at Apple looking at this forum and at hannob's bashcheck and that it would get tested. I guess there will be a 1.1 version of the update soon?
scintill76 12y ago
"Variable function parser inactive" -- interesting, did they apply the unofficial patch to namespace-prefix function definitions? This poster[0] seems to not have it, though. Who is right? The test at that github link seems a bit sketchy, by using a simple name like "a" instead of, say, __test_bashbug_a, and not checking the output very thoroughly. But it seems like it would fail the other way if there's a command named "a" in OS X's PATH... https://news.ycombinator.com/item?id=8385819 https://news.ycombinator.com/item?id=8385819
- mcpherrinm 12y ago
  It isn't unoffical anymore. For bash3.2, which seems to be what apple is distributing, that patch is ftp://ftp.gnu.org/pub/gnu/bash/bash-3.2-patches/bash32-054

porsupah 12y ago

For anyone curious, the package installer will refuse to run on Yosemite, declaring it requires OS X 10.9. (Of peripheral interest, whilst checking in the iOS Dev Center, I noticed there's a beta of iOS 8.1)

xyclos 12y ago
yeah, despite the statement: "OS X Mavericks v10.9.5 or later"
- mitchty 12y ago
  Probably only applies to released versions of OS X. Apple treats beta a bit differently than I think many expect. It is a bit closer to the old school definition.
  - orbitur 12y ago
    Highly likely. I don't see why Apple would "patch" something that's not out yet. Since we didn't see another DP this week, I'm assuming the Bash update will appear in the RC... hopefully that's out soon.
    - mitchty 12y ago
      Yep, and if you're really hard up to get it into 10.10. Just extract the relevant binaries from the 10.9 version. Though a better question would be what the hell are you doing with 10.10 that you need to. OS X betas are very much beta. https://gist.github.com/mitchty/6e835bb51735099b6eba https://gist.github.com/mitchty/6e835bb51735099b6eba

vectorsize 12y ago

no https? no checksums?

aroch 12y ago
All of Apple's OS updaters are signed by Apple's internal CA and verified at install time -- that's why there's no checksum: http://idzr.org/ba4o http://idzr.org/ba4o

pudquick 12y ago

Do note: This addresses CVE-2014-6271 and CVE-2014-7169 only. There are currently 6 CVEs listed on the Wikipedia page (not sure which are accurate): http://en.wikipedia.org/wiki/Shellshock_%28software_bug%29#Subsequent_reports http://en.wikipedia.org/wiki/Shellshock_%28software_bug%29#S... Some protection is better than none and I'm glad to see Apple rapidly responding. But this doesn't fix all the issues known to exist currently.

simme_ 12y ago
> I'm glad to see Apple rapidly responding It seems we have different expectations concerning the term rapid...
- pudquick 12y ago
  Disclosure was on the 24th, today is the 29th. The patch had to be developed in-between (released on the 26th I think?). 3-5 days is pretty decent considering that the DHCP stack on OS X isn't vulnerable and only customers that had enabled the apache2 instance and configured it with non-default mods were possibly affected. More often than not Apple is removing GPL code from OS X altogether in the face of issues (example: samba is now replaced with 'smbx' in-house implementation). I felt it was 50/50 that they'd update it vs. remove/disable it.
  - eridius 12y ago
    Kind of hard to remove Bash when it's the default shell and a great many scripts have been written targeting Bash features. Sure, there are other sh-compatible shells, but AFAIK they aren't 100% compatible with Bash. Edit: If you disagree with me, please reply instead of downvoting.
    - deleted 12y ago
      [deleted]
    - dangerlibrary 12y ago
      Let's hope they aren't 100% compatible!

auvi 12y ago

Before: $ bash --version GNU bash, version 3.2.51(1)-release (x86_64-apple-darwin13) After: $ bash --version GNU bash, version 4.3.26(1)-release (x86_64-apple-darwin13.4.0)

goalieca 12y ago
Huh? I didn't get that at all. Are you running ports maybe?? $ bash --version GNU bash, version 3.2.51(1)-release (x86_64-apple-darwin13) Copyright (C) 2007 Free Software Foundation, Inc. $ bash --version GNU bash, version 3.2.53(1)-release (x86_64-apple-darwin13) Copyright (C) 2007 Free Software Foundation, Inc.
Igglyboo 12y ago
There's no way they're pushing out a GPLv3 version of bash, you sure you didn't confuse it with a brew/macports installed version?
- sigjuice 12y ago
  From Apple's email announcement http://lists.apple.com/archives/security-announce/2014/Sep/msg00001.html http://lists.apple.com/archives/security-announce/2014/Sep/m... * The version after applying this update will be: OS X Mavericks: GNU bash, version 3.2.53(1)-release (x86_64-apple-darwin13) OS X Mountain Lion: GNU bash, version 3.2.53(1)-release (x86_64-apple-darwin12) OS X Lion: GNU bash, version 3.2.53(1)-release (x86_64-apple-darwin11)
deleted 12y ago
[deleted]
dmytrish 12y ago
Indeed, port install bash cat /opt/local/bin/bash >> /etc/shells chsh -s /opt/local/bin/bash mv /bin/bash /bin/bash-apple ln /opt/local/bin/bash /bin/bash solves the problem.

Fastidious 12y ago

"OS X Mavericks v10.9.5 or later" doesn't include Yosemite.

sigzero 12y ago
Yosemite isn't out yet except in Beta. So that is understandable really.
- Fastidious 12y ago
  That doesn't make any sense. Yosemite is on DP and Public beta, yet still vulnerable. One thing has nothing to do with the other.
Watabou 12y ago
We will probably get another DP tomorrow as it has been two weeks now since the previous DP
- orbitur 12y ago
  They updated Xcode and iOS today, no DP. Makes me think we'll see the RC, maybe, hopefully.

BenjiGriff 12y ago

Great! This should fix that lockscreen bug and a few others. But lets keep our fingers crossed now.

mjcohen 12y ago

Worked on my Lion MacBook Pro. Went to the terminal which previously said "vulnerable", redid the command, now ok.

orblivion 12y ago

Anybody know what took them so long?

yachi 12y ago
Because they just upgraded to xcode 6.

mkoryak 12y ago

sadly this will update bash on 10.9.5 only. Im on 10.9.3 because the last mac I updated to that version caused it to kernel panic whenever I connected an external monitor. Mavericks is apple's Windows Vista

deleted 12y ago

[deleted]

bluedino 12y ago

What about the handful of 10.5 machines still running?

deleted 12y ago

[deleted]

unspecified 12y ago

Hmph, the other thread fell off the front page, but: There is a handy zsh script (zsh is in /bin on OSX by default) to get the Bash tarball from opensource.apple.com, apply patches 52, 53, and 54 from ftp.gnu.org, build it, and then prompt to replace /bin/bash and /bin/sh. Xcode is required, and you have to run "sudo xcodebuild" once to accept the EULA. https://github.com/tjluoma/bash-fix https://github.com/tjluoma/bash-fix This is the easiest way I've found to patch the system-level /bin/bash AND /bin/sh binaries.

aabdocker 12y ago

No surprise it doesn't work on 10.10.

mythz 12y ago

Website says `OS X Mavericks v10.9.5 or later` but fails to run in Yosemite with the error alert: > This update requires OS X version 10.9.

deleted 12y ago

[deleted]

alblue 12y ago

Note that Apple has not provided updates for older systems. If you have an older system and wish to patch, I have been keeping my blog post [1] updated along with the canonical StackExchange answer [2]. Note that the patch from Apple allows bash functions to be escaped, albeit with a BASH_FUNC prefix - but you can get around this by using: $ env '__BASH_FUNC<ls>()'="() { echo Game Over; }" bash -c ls Game Over [1] http://alblue.bandlem.com/2014/09/bash-remote-vulnerability.html http://alblue.bandlem.com/2014/09/bash-remote-vulnerability.... [2] http://apple.stackexchange.com/questions/146849/ http://apple.stackexchange.com/questions/146849/

osxrand 12y ago
Unless you're talking about 10.6 or older : Quoted from 0x0 Also for 10.8: http://support.apple.com/kb/DL1768 http://support.apple.com/kb/DL1768 And for 10.7: http://support.apple.com/kb/DL1767 http://support.apple.com/kb/DL1767 Edit: Further information from the announcement is available here: http://lists.apple.com/archives/security-announce/2014/Sep/m.. http://lists.apple.com/archives/security-announce/2014/Sep/m.... Just posting it here incase someone reads your comment and misses 0x0's

bstream 12y ago

(master) $ echo $BASH_VERSION 4.3.27(1)-release (master) $ ./bashcheck Not vulnerable to CVE-2014-6271 (original shellshock) Not vulnerable to CVE-2014-7169 (taviso bug) ./bashcheck: line 18: 7675 Segmentation fault: 11 bash -c "true $(printf '<<EOF %.0s' {1..79})" 2> /dev/null Vulnerable to CVE-2014-7186 (redir_stack bug) Test for CVE-2014-7187 not reliable without address sanitizer Variable function parser inactive, likely safe from unknown parser bugs It seems as though there is no patch that fixes CVE-2014-7186 yet?

brynmathias 12y ago

Word of warning, if you have chmod 0000 /bin/bash put it back to how you found it before running the update. If you didn't do this: cmd + s to boot in safe mode. /sbin/mount -wu / and chmod bash back to a useable state, if you get stuck at log in.

GeorgeOfTJungle 12y ago

http://hacksagogo.wordpress.com/2014/10/02/shell-shock-os-x-bash-update-installer-for-snow-leopard/ http://hacksagogo.wordpress.com/2014/10/02/shell-shock-os-x-... Here’s for the crazy ones, the misfits, the trouble makers, the round pegs in the square holes. The ones who see things differently... and are still running Snow Leopard.