6 ms·
With the update installed: $ curl -s https://raw.githubusercontent.com/hannob/bashcheck/master/bashcheck | bash Not vulnerable to CVE-2014-6271 (original s
by Titanous 12y ago
With the update installed:
$ curl -s https://raw.githubusercontent.com/hannob/bashcheck/master/bashcheck | bash
Not vulnerable to CVE-2014-6271 (original shellshock)
Not vulnerable to CVE-2014-7169 (taviso bug)
bash: line 18: 14885 Segmentation fault: 11 bash -c "true $(printf '<<EOF %.0s' {1..79})" 2> /dev/null
Vulnerable to CVE-2014-7186 (redir_stack bug)
Test for CVE-2014-7187 not reliable without address sanitizer
Variable function parser inactive, likely safe from unknown parser bugs
- gphil 12y agoI just reproduced this on 10.9.5 as well.
- deleted 12y ago[deleted]
- ten7 12y agoAlso reproduced on 10.9.5 -- you would think that there's sometone at Apple looking at this forum and at hannob's bashcheck and that it would get tested. I guess there will be a 1.1 version of the update soon?
- scintill76 12y ago"Variable function parser inactive" -- interesting, did they apply the unofficial patch to namespace-prefix function definitions? This poster[0] seems to not have it, though. Who is right? The test at that github link seems a bit sketchy, by using a simple name like "a" instead of, say, __test_bashbug_a, and not checking the output very thoroughly. But it seems like it would fail the other way if there's a command named "a" in OS X's PATH... https://news.ycombinator.com/item?id=8385819 https://news.ycombinator.com/item?id=8385819
- mcpherrinm 12y agoIt isn't unoffical anymore. For bash3.2, which seems to be what apple is distributing, that patch is ftp://ftp.gnu.org/pub/gnu/bash/bash-3.2-patches/bash32-054
- f- 12y agoThey applied the unofficial one. The official one uses a different suffix.
- scintill76 12y agoCool, thanks for the pointer.
- ahomescu1 12y agoAfter testing it by doing: $ foo() { echo foo; } $ foo foo $ export -f foo I got this variable: __BASH_FUNC<foo>()=() { echo foo }
- jonahx 12y agoHow can I patch the bugs that are listed as still vulnerable?
- landr0id 12y agobrew install bash
- matkam 12y agoThis still keeps the system version around at /bin/bash
- jonahx 12y agoStill showing as vulnerable even after that: ~$ echo $BASH_VERSION 4.3.25(1)-release ~$ curl -s https://raw.githubusercontent.com/hannob/bashcheck/master/bashcheck | bash bash: warning: x: ignoring function definition attempt bash: error importing function definition for `x' Not vulnerable to CVE-2014-6271 (original shellshock) Vulnerable to CVE-2014-7169 (taviso bug) bash: line 18: 1339 Segmentation fault: 11 bash -c "true $(printf '<<EOF %.0s' {1..79})" 2> /dev/null Vulnerable to CVE-2014-7186 (redir_stack bug) Test for CVE-2014-7187 not reliable without address sanitizer Variable function parser still active, likely vulnerable to yet unknown parser bugs like CVE-2014-6277 (lcamtuf bug) And fwiw even before install new bash via homebrew I had also followed these instructions: http://apple.stackexchange.com/questions/146849/how-do-i-recompile-bash-to-avoid-shellshock-the-remote-exploit-cve-2014-6271-an http://apple.stackexchange.com/questions/146849/how-do-i-rec...
- wyager 12y agoDon't forget to change your PATH so brew-installed things come before other things. Brew installs bash at `/usr/local/bin/`.
- hollerith 12y agoThat doesn't solve the problem of scripts that begin with #!/bin/bash
- orblivion 12y agoI'm sorry for being snarky, but something seems funny to me about piping something straight from github through bash to check for a security flaw.
- orblivion 12y ago(Oh actually, you could probably do it pretty safely with a guest account.)
- peteretep 12y agoWhy does piping commands in to bash from the internet take on a magical security significance for people who run software they haven't audited literally all the time?
- zorpner 12y agoIn the case of a network interruption, a command could become truncated with potentially destructive results.
- e12e 12y agoYou don't see the difference between running an exploit to check if you're vulnerable to a security bug, and running software provided by your upstream distribution?
- peteretep 12y ago
- MaysonL 12y agoFrom Yosemite GM candidate: Not vulnerable to CVE-2014-6271 (original shellshock) Not vulnerable to CVE-2014-7169 (taviso bug) Not vulnerable to CVE-2014-7186 (redir_stack bug) Test for CVE-2014-7187 not reliable without address sanitizer Variable function parser inactive, likely safe from unknown parser bugs