4

I'm running Bash version 2.05b.0(1)-release (powerpc-apple-darwin8.0) on a PowerMac (non-Intel) G5. I often connect to the internet, but not as a server and I believe my version of Bash is vulnerable to the Shellshock exploit.

Upgrading the OS past 10.4.11 Tiger is not an option as this computer can't be upgraded for reasons.

Can I recompile bash for my system or are there any users who may have devised a patch?

Improve this question
4
  • You have way bigger security issues to worry about if you're still on OS X 10.4.
    – user79406
    Commented Sep 26, 2014 at 21:07
  • I try to mitigate threats, but you have a point.
    – Poor Old PPC
    Commented Sep 26, 2014 at 21:14
  • If all you do is to connect to the internet (and you probably mean: using Safari to browse web sites), then you have nothing to worry from the bash issue. It only applies if you run an HTTP server, make it accessible to the public (i.e. open up the right ports in your firewall) and use apache/CGI to build some web apps. A pretty unlikely combination for an old PowerMac.
    – Albert Godfrind
    Commented Sep 29, 2014 at 12:58
  • Love people that keep on using old hardware and old software. Forgive the edit, but I wanted to have the flow of the question end with the "ask".
    – bmike ♦
    Commented Sep 30, 2014 at 13:36

4 Answers 4

Reset to default
3

MacPorts still supports 10.4 and you can install the latest bash with it by running sudo port install bash and following the instructions in the output (the command will ask you to do a few more things).

This will take many (40+) hours because it first compiles apple-gcc42 to compile gcc7, then uses that to compile bash.

Improve this answer
1

Do you have gcc and other tools installed? You can check with which gcc and then gcc --version. If you don't, you can install these from the Developers Tools DVD that came with the system, or you can download from Apple or gnu, but it might be tricky to get a version that will run.

Once you have gcc and the other command line tools installed, the next challenge is to obtain a bash source that will successfully compile and build on an old OS. I'm going to try this myself for 10.5 and 10.6.

Note that you don't need to worry about having a vulnerable Bash if the machine doesn't run a web server and isn't running services exposed to anyone but you. If you're the only user, and you don't run web sharing or other external services, you don't need to both.

Improve this answer
3
  • Thanks for the quick answer. No, I don't share except through Dropbox. Apparently I am immune. What kind of "external services" should I be aware of?
    – Poor Old PPC
    Commented Sep 26, 2014 at 20:43
  • Web sharing and remote login are the big ones, since CGI scripts can be Bash shell scripts and since remote login almost always invokes a shell script. I don't know if other services are vulnerable (such as email or FTP) -- I doubt it, but I don't want to say they are fine if I don't know for sure.
    – jetset
    Commented Sep 26, 2014 at 20:50
  • Web Sharing's apache doesn't enable mod_cgi by default, so that should not be a vector of attack. There is little risk to the vast majority of users. That said, compiling one's own binaries is not all that difficult and patching an old system is always a good idea.
    – Trane Francks
    Commented Sep 30, 2014 at 22:10
1

As a stopgap, the easiest way to patch your system with a newer version of bash would be to use the version (4.3.30) available at the TenFourFox blog:

http://tenfourfox.blogspot.com/2014/09/bashing-bash-one-more-time-updated.html

The author provides step-by-step instructions for installing this version of bash.

Once you've gotten that preliminary patch successfully installed, it would be wise to compile and install the most up-to-date patched version of bash for your system. As others point out, you can either compile and install bash 2.05b (the version that came with Tiger) with all of the latest patches, or the very latest version with all the most recent patches (4.3.30). Either way, you'll likely need to compile and install these yourself.

If you do feel comfortable with compiling and building these yourself, then Tigerbrew will likely be of great help in accomplishing this. With Tigerbrew you can not only download and build a far more modern version of the gcc compiler (v4.9.1), but also bash 4.3.30. (Note that you'll need to have Xcode 2.5 installed before you install Tigerbrew.)

Improve this answer
0

The mechanisms of updating bash on your Tiger system are similar for those on later systems. If you're comfortable with compiling and installing your own programs, this may not be outside the realm of possibility, but if you're not familiar with compilers, Makefiles and the gotchas that can come with trying to do it the non-Apple way, you may well be better off leaving it as is. If you're not running Web Sharing, remote login, ssh or other services, you don't have too much about which to worry. CUPS, OS X's printing subsystem, is vulnerable due to the way it interacts with bash, but the risk here is minimal.

If you really want to examine the steps involved, I wrote this summary based on OS X Lion 10.7.5:

https://apple.stackexchange.com/a/146943/91441

Significant differences will be your starting point. For one thing, you really do want to keep your base bash --version as the starting point. So, where the Lion and later systems would use v3.2.48 as the base, you'd want v2.05b:

http://ftp.gnu.org/gnu/bash/bash-2.05b.tar.gz

And then you'd download all 9 of the patches from:

http://ftp.gnu.org/gnu/bash/bash-2.05b-patches/

Even using my Ask Different article as a template, you may run into problems. Note the comments under the article in which one Snow Leopard user ran into issues because the GNU sources were looking for a different version of readline in order to compile. You may or may not run into the same problem. You may run into others.

Best of luck with it. As pointed out elsewhere, you'd do well to consider moving from Tiger to a supported version of OS X. Currently, the oldest supported OS X version is Lion 10.7.5. Everything older than that has been end-of-lifed by Apple. Lion will likely go the way of the dodo as soon as Yosemite is released.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .