Linked Questions

58
votes
5answers
29k views

Are Macs vulnerable to the Bash shellshock bug?

Red Hat recently announced a major security-related bug in the Bash shell. Some are calling it the "shellshock" bug. Since OS X is built off of Unix, is it vulnerable to attacks that exploit this bug? ...
3
votes
6answers
3k views

Can bash be replaced entirely in OS X?

Because of CVE-2014-6271 and CVE-2014-7169 on OS X I was wondering: can bash be replaced entirely by another, non-affected shell (eg dash or others)?
7
votes
2answers
2k views

Are Bash, Bourne, and Korn shells compiled into one binary in OSX?

On OSX 10.8, if you compare the binaries for bash, sh, and ksh, a few different shell options, they are the same size. If you take it further and cmp the binaries, there seems to be only a single-...
3
votes
3answers
2k views

Apple Shellshock patch for 10.6?

I am running a small HTTP server (Apache) off my Mac mostly as a hobby. If it becomes compromised it isn't the end of the world but it is something I would certainly like to prevent. I set up a ...
3
votes
3answers
3k views

Any way to update OSX 10.4's Bash version?

I'm running Bash version 2.05b.0(1)-release (powerpc-apple-darwin8.0) on a PowerMac (non-Intel) G5. I often connect to the internet, but not as a server and I believe my version of Bash is vulnerable ...
1
vote
1answer
2k views

How can I fix this CODESIGNING error?

After having successfully compiled bash and sh for OS X Mavericks our OS X Server's System Log is flooded every 2 or 3 seconds with: ... kernel[0]: CODESIGNING: rejected new signature for ...
0
votes
1answer
4k views

is there a patch against “Shell Shock” for my system MacOS 10.6.8 bash version 3.2.48(1)-release (x86_64-apple-darwin10.0) [duplicate]

I already run the following and I get "vulnerable" Mac cysunza$ env x='() { :;}; echo vulnerable' bash -c 'echo hello' vulnerable hello I read the post about it but appears to me that his is just for ...
6
votes
1answer
827 views

Are there any disadvantages to using the brew version of bash for /bin/sh?

I have patched bash & sh with the latest patches as described here, but now have some issues with some things in my dotfiles (particularly the loading of rvm and some custom functions and ...
2
votes
2answers
633 views

OS X Terminal – Open Tab in current directory, troubles with umlauts

I run OS X 10.7.5. I am currently experiencing an issue with Terminal. I have enabled the option to open new tabs in the current working directory. However, this does not work as expected, when the ...
5
votes
1answer
365 views

How to mitigate Bash risk while waiting for a patch (sans a recompile)?

This is related to How do I recompile Bash to avoid the remote exploit CVE-2014-6271 and CVE-2014-7169?, Are Macs vulnerable to the Bash shellshock bug? and Are Bash, Bourne, and Korn shells compiled ...
3
votes
1answer
196 views

Will recompiling bash to avoid Shellshock cause more harm than good

I wasn't particularly worried about Shellshock until I learned that a malicious DHCP server may be able to exploit my DHCP client to run arbitrary code on my system. It's not clear to me whether Macs ...
1
vote
1answer
95 views

Bash on OS X 10.4 ftp server

I am running OS X 10.4 on a G4 using Rumpus software for a FTP server. I keep reading I do not have to worry about Bash Bug if I am not running a web server or other services. does my FTP server ...
1
vote
1answer
82 views

Recompiling bash to avoid shellshock seems to have messed up bash

I probably shouldn't have even messed with it, but I followed the instructions to recompile bash here: How do I recompile Bash to avoid Shellshock (the remote exploit CVE-2014-6271 and CVE-2014-7169)? ...