jmmitc06
Member
So for those who may have heard, there is an exploit in bash (a shell provided with most *unix distros) that allows for remote code injection and execution. This is not a major concern on personal devices and is only a real problem if other security problems are present (your account has root privileges, you have a CGI script that can change environment variables etc. ) but based on the security questions that arise in all of the computer threads that come up in the lounge I thought I would post this. It's worth doing regardless since there isn't any real downside. Additionally although most OSX users probably aren't mucking around in terminal all day like us pasty white computer programmers, many programs and services use bash in the background.
Most of the *unix distros have already had this patch applied to the distros and you can fix it with a simple update (e.g yum update). But the mac users, myself included, as of now do not have a fix from apple. Luckily you can fix it yourself, and you don't need anything fancy. Here are the steps:
0a) if you don't have xcode installed, download it for free from the app store, you will need it to recompile bash.
0b) now open a terminal and check if you are vulnerable by running this command:
if the word 'vulnerable' prints to the terminal, you need to do the following steps in terminal...
1) download and compile the patch (the last step may take a while but it was fast on my machine):
2) backup the old bash just in case
3) verify the version of your new bash, you should get version 3.2.52(1)-release
4) replace old bash with your new patched version
5) once you have the new copy moved over, mark the old one as non-executable
6) enjoy your new shell until apple gets around to making their own update, which will basically be the one you just did.
Again, this isn't a major security concern but given the severity of what can be done with the exploit if there is even the smallest chink in your computer's security it's worth fixing. After the patch is applied run:
and you will see the following:
showing that bash can no longer inject code through 'env'
Most of the *unix distros have already had this patch applied to the distros and you can fix it with a simple update (e.g yum update). But the mac users, myself included, as of now do not have a fix from apple. Luckily you can fix it yourself, and you don't need anything fancy. Here are the steps:
0a) if you don't have xcode installed, download it for free from the app store, you will need it to recompile bash.
0b) now open a terminal and check if you are vulnerable by running this command:
Code:
env x='() { :;}; echo vulnerable' bash -c 'echo hello'if the word 'vulnerable' prints to the terminal, you need to do the following steps in terminal...
1) download and compile the patch (the last step may take a while but it was fast on my machine):
Code:
mkdir bash-fix
cd bash-fix
curl https://opensource.apple.com/tarballs/bash/bash-92.tar.gz | tar zxf -
cd bash-92/bash-3.2
curl https://ftp.gnu.org/pub/gnu/bash/bash-3.2-patches/bash32-052 | patch -p0
cd ..
xcodebuild2) backup the old bash just in case
Code:
sudo cp /bin/bash /bin/bash.old
sudo cp /bin/sh /bin/sh.old3) verify the version of your new bash, you should get version 3.2.52(1)-release
Code:
build/Release/bash --version
build/Release/sh --version4) replace old bash with your new patched version
Code:
sudo cp build/Release/bash /bin
sudo cp build/Release/sh /bin5) once you have the new copy moved over, mark the old one as non-executable
Code:
sudo chmod a-x /bin/bash.old /bin/sh.old6) enjoy your new shell until apple gets around to making their own update, which will basically be the one you just did.
Again, this isn't a major security concern but given the severity of what can be done with the exploit if there is even the smallest chink in your computer's security it's worth fixing. After the patch is applied run:
Code:
env x='() { :;}; echo vulnerable' bash -c 'echo hello'and you will see the following:
Code:
bash: warning: x: ignoring function definition attempt
bash: error importing function definition for `x'showing that bash can no longer inject code through 'env'
Last edited:
