# Any way to update OSX 10.4's Bash version?

I'm running Bash version 2.05b.0(1)-release (powerpc-apple-darwin8.0) on a PowerMac (non-Intel) G5. I often connect to the internet, but not as a server and I believe my version of Bash is vulnerable to the Shellshock exploit.

Upgrading the OS past 10.4.11 Tiger is not an option as this computer can't be upgraded for reasons.

Can I recompile bash for my system or are there any users who may have devised a patch?

• You have way bigger security issues to worry about if you're still on OS X 10.4. – user79406 Sep 26 '14 at 21:07
• I try to mitigate threats, but you have a point. – Poor Old PPC Sep 26 '14 at 21:14
• If all you do is to connect to the internet (and you probably mean: using Safari to browse web sites), then you have nothing to worry from the bash issue. It only applies if you run an HTTP server, make it accessible to the public (i.e. open up the right ports in your firewall) and use apache/CGI to build some web apps. A pretty unlikely combination for an old PowerMac. – Albert Godfrind Sep 29 '14 at 12:58
• Love people that keep on using old hardware and old software. Forgive the edit, but I wanted to have the flow of the question end with the "ask". – bmike Sep 30 '14 at 13:36

Do you have gcc and other tools installed? You can check with which gcc and then gcc --version. If you don't, you can install these from the Developers Tools DVD that came with the system, or you can download from Apple or gnu, but it might be tricky to get a version that will run.

Once you have gcc and the other command line tools installed, the next challenge is to obtain a bash source that will successfully compile and build on an old OS. I'm going to try this myself for 10.5 and 10.6.

Note that you don't need to worry about having a vulnerable Bash if the machine doesn't run a web server and isn't running services exposed to anyone but you. If you're the only user, and you don't run web sharing or other external services, you don't need to both.

• Thanks for the quick answer. No, I don't share except through Dropbox. Apparently I am immune. What kind of "external services" should I be aware of? – Poor Old PPC Sep 26 '14 at 20:43
• Web sharing and remote login are the big ones, since CGI scripts can be Bash shell scripts and since remote login almost always invokes a shell script. I don't know if other services are vulnerable (such as email or FTP) -- I doubt it, but I don't want to say they are fine if I don't know for sure. – jetset Sep 26 '14 at 20:50
• Web Sharing's apache doesn't enable mod_cgi by default, so that should not be a vector of attack. There is little risk to the vast majority of users. That said, compiling one's own binaries is not all that difficult and patching an old system is always a good idea. – Trane Francks Sep 30 '14 at 22:10

As a stopgap, the easiest way to patch your system with a newer version of bash would be to use the version (4.3.30) available at the TenFourFox blog:

http://tenfourfox.blogspot.com/2014/09/bashing-bash-one-more-time-updated.html

The author provides step-by-step instructions for installing this version of bash.

Once you've gotten that preliminary patch successfully installed, it would be wise to compile and install the most up-to-date patched version of bash for your system. As others point out, you can either compile and install bash 2.05b (the version that came with Tiger) with all of the latest patches, or the very latest version with all the most recent patches (4.3.30). Either way, you'll likely need to compile and install these yourself.

If you do feel comfortable with compiling and building these yourself, then Tigerbrew will likely be of great help in accomplishing this. With Tigerbrew you can not only download and build a far more modern version of the gcc compiler (v4.9.1), but also bash 4.3.30. (Note that you'll need to have Xcode 2.5 installed before you install Tigerbrew.)

The mechanisms of updating bash on your Tiger system are similar for those on later systems. If you're comfortable with compiling and installing your own programs, this may not be outside the realm of possibility, but if you're not familiar with compilers, Makefiles and the gotchas that can come with trying to do it the non-Apple way, you may well be better off leaving it as is. If you're not running Web Sharing, remote login, ssh or other services, you don't have too much about which to worry. CUPS, OS X's printing subsystem, is vulnerable due to the way it interacts with bash, but the risk here is minimal.

If you really want to examine the steps involved, I wrote this summary based on OS X Lion 10.7.5:

https://apple.stackexchange.com/a/146943/91441

Significant differences will be your starting point. For one thing, you really do want to keep your base bash --version as the starting point. So, where the Lion and later systems would use v3.2.48 as the base, you'd want v2.05b:

http://ftp.gnu.org/gnu/bash/bash-2.05b.tar.gz

Even using my Ask Different article as a template, you may run into problems. Note the comments under the article in which one Snow Leopard user ran into issues because the GNU sources were looking for a different version of readline in order to compile. You may or may not run into the same problem. You may run into others.