Linked Questions

58 votes
5 answers
29k views

Are Macs vulnerable to the Bash shellshock bug?

Red Hat recently announced a major security-related bug in the Bash shell. Some are calling it the "shellshock" bug. Since OS X is built off of Unix, is it vulnerable to attacks that exploit this bug? ...
user avatar
  • 2,863
3 votes
6 answers
4k views

Can bash be replaced entirely in OS X?

Because of CVE-2014-6271 and CVE-2014-7169 on OS X I was wondering: can bash be replaced entirely by another, non-affected shell (eg dash or others)?
user avatar
  • 41
7 votes
2 answers
2k views

Are Bash, Bourne, and Korn shells compiled into one binary in OSX?

On OSX 10.8, if you compare the binaries for bash, sh, and ksh, a few different shell options, they are the same size. If you take it further and cmp the binaries, there seems to be only a single-...
user avatar
  • 193
1 vote
1 answer
3k views

How can I fix this CODESIGNING error?

After having successfully compiled bash and sh for OS X Mavericks our OS X Server's System Log is flooded every 2 or 3 seconds with: ... kernel[0]: CODESIGNING: rejected new signature for ...
user avatar
  • 431
3 votes
3 answers
3k views

Any way to update OSX 10.4's Bash version?

I'm running Bash version 2.05b.0(1)-release (powerpc-apple-darwin8.0) on a PowerMac (non-Intel) G5. I often connect to the internet, but not as a server and I believe my version of Bash is vulnerable ...
user avatar
3 votes
3 answers
2k views

Apple Shellshock patch for 10.6?

I am running a small HTTP server (Apache) off my Mac mostly as a hobby. If it becomes compromised it isn't the end of the world but it is something I would certainly like to prevent. I set up a ...
user avatar
6 votes
1 answer
1k views

Are there any disadvantages to using the brew version of bash for /bin/sh?

I have patched bash & sh with the latest patches as described here, but now have some issues with some things in my dotfiles (particularly the loading of rvm and some custom functions and ...
user avatar
0 votes
1 answer
4k views

is there a patch against "Shell Shock" for my system MacOS 10.6.8 bash version 3.2.48(1)-release (x86_64-apple-darwin10.0) [duplicate]

I already run the following and I get "vulnerable" Mac cysunza$ env x='() { :;}; echo vulnerable' bash -c 'echo hello' vulnerable hello I read the post about it but appears to me that his is just for ...
user avatar
2 votes
2 answers
783 views

OS X Terminal – Open Tab in current directory, troubles with umlauts

I run OS X 10.7.5. I am currently experiencing an issue with Terminal. I have enabled the option to open new tabs in the current working directory. However, this does not work as expected, when the ...
user avatar
  • 1,871
5 votes
1 answer
375 views

How to mitigate Bash risk while waiting for a patch (sans a recompile)?

This is related to How do I recompile Bash to avoid the remote exploit CVE-2014-6271 and CVE-2014-7169?, Are Macs vulnerable to the Bash shellshock bug? and Are Bash, Bourne, and Korn shells compiled ...
user avatar
3 votes
1 answer
208 views

Will recompiling bash to avoid Shellshock cause more harm than good

I wasn't particularly worried about Shellshock until I learned that a malicious DHCP server may be able to exploit my DHCP client to run arbitrary code on my system. It's not clear to me whether Macs ...
user avatar
1 vote
1 answer
104 views

Bash on OS X 10.4 ftp server

I am running OS X 10.4 on a G4 using Rumpus software for a FTP server. I keep reading I do not have to worry about Bash Bug if I am not running a web server or other services. does my FTP server ...
user avatar
  • 11
1 vote
1 answer
97 views

Recompiling bash to avoid shellshock seems to have messed up bash

I probably shouldn't have even messed with it, but I followed the instructions to recompile bash here: How do I recompile Bash to avoid Shellshock (the remote exploit CVE-2014-6271 and CVE-2014-7169)? ...
user avatar