Status

Apple have released Bash security fixes. It's available directly in software update and via different URLs based on the operating system version:

• https://support.apple.com/kb/DL1769 - Mavericks (10.9.5 and above)
• https://support.apple.com/kb/DL1768 - Mountain Lion (10.8.5)
• https://support.apple.com/kb/DL1767 - Lion (10.7.5)

HOWEVER note that the official patch provides GNU bash, version 3.2.53(1)-release (x86_64-apple-darwin13) but the Game over bug is still vulnerable.

(To whomever deleted these links from the post 9 hours ago; you were not helpful to the community.)

An official patch of bash itself for bash 3.2 patch 54 is available which fixes both CVE-2014-6271 and CVE-2014-7168, as well as the 'Game over' displayed below. This has been tested by me (@alblue) and the post has been updated accordingly. Apple has also provided updates for individual versions of Mac OS X - although this is not available through the normal Software Update process yet.

Both NetBSD and FreeBSD have disabled auto-importing bash functions by default, to contain any further errors in the parser. I (@alblue) have prepared a patch (against 3.2.53) for others to use if they want to adopt this behaviour as well. This can be built by setting the environment variable as described below. By default this is not enabled.

Testing for the original Vulnerability

You can determine if you are vulnerable to the original problem in CVE-2014-6271 by executing this test:

$ env x='() { :;}; echo vulnerable' bash -c 'echo hello'
bash: warning: x: ignoring function definition attempt
bash: error importing function definition for `x'
hello

The above output is an example of a non-vulnerable bash version. If you see the word vulnerable in the output of that command your bash is vulnerable and you should update. Below is a vulnerable version from OS X 10.8.5:

Testing for the new Vulnerability

There has been an update to the original post and Bash 3.2.52(1) is still vulnerable to a variation of the vulnerability, defined in CVE-2014-7169

$ rm -f echo
$ env X='() { (a)=>\' sh -c "echo date"; cat echo
sh: X: line 1: syntax error near unexpected token `='
sh: X: line 1: `'
sh: error importing function definition for `X'
Thu 25 Sep 2014 08:50:18 BST

The above output is an example of a vulnerable bash version. If you see a date in the output of that command your bash is vulnerable.

Disabling auto-imported functions

There is an additional up-stream patch which is released to upstream bash that prefixes the imported functions with a BASH_FUNC prefix. This prevents the Game over being displayed:

$ env ls="() { echo 'Game over'; }" bash -c ls
Game over

Both NetBSD and FreeBSD have disabled auto-imported functions by default, and have added a new command line flag --import-functions to enable this. I (@alblue) have prepared a patch for bash 3.2.53 which adds this functionality as well. It is included in the below, and can be enabled by running export ADD_IMPORT_FUNCTIONS_PATCH=YES before running the build.

(Note to question editors; please do not enable this by default, as it is an unofficial patch.)

a0c5c4d66742fddd0a35001cb91798a5fbf8a2f5 import_functions.patch

Apple Patch has Game Over vulnerability

As pointed out by @ake_____ on twitter the official Apple patch is still vulnerable to environment clobbering of executables:

$ env '__BASH_FUNC<ls>()'="() { echo Game Over; }" bash -c ls
Game Over

Users should wait to see if Apple updates the patch or alternatively use the approach to disable all imported functions by default as per the section above.

System Binaries

OS X 10.9.5 (the latest stable release at the moment) ships with Bash v3.2.51:

$ bash --version
GNU bash, version 3.2.51(1)-release (x86_64-apple-darwin13)
Copyright (C) 2007 Free Software Foundation, Inc.

You can obtain and recompile Bash as follows, providing that you have Xcode installed (and have run xcodebuild at least once before to accept the license):

$ # If you want to disable auto-imported functions, uncomment the following
$ # export ADD_IMPORT_FUNCTIONS_PATCH=YES
$ mkdir bash-fix
$ cd bash-fix
$ curl https://opensource.apple.com/tarballs/bash/bash-92.tar.gz | tar zxf -
$ cd bash-92/bash-3.2
$ curl https://ftp.gnu.org/pub/gnu/bash/bash-3.2-patches/bash32-052 | patch -p0    
$ curl https://ftp.gnu.org/pub/gnu/bash/bash-3.2-patches/bash32-053 | patch -p0  
$ # See note above about ADD_IMPORT_FUNCTIONS_PATCH
$ [ "$ADD_IMPORT_FUNCTIONS_PATCH" == "YES" ] && curl http://alblue.bandlem.com/import_functions.patch | patch -p0
$ [ "$ADD_IMPORT_FUNCTIONS_PATCH" == "YES" ] || curl https://ftp.gnu.org/pub/gnu/bash/bash-3.2-patches/bash32-054 | patch -p0
$ cd ..
$ # Note: DO NOT ADD SUDO TO XCODEBUILD HERE
$ xcodebuild
$ build/Release/bash --version # GNU bash, version 3.2.54(1)-release
$ build/Release/sh --version   # GNU bash, version 3.2.54(1)-release
$ sudo cp /bin/bash /bin/bash.old
$ sudo cp /bin/sh /bin/sh.old
$ sudo cp build/Release/bash /bin
$ sudo cp build/Release/sh /bin

(Note: you can run this by copy-and-pasting the above code block, going into Terminal and then running pbpaste | cut -c 2- | sh. Always take care when running random scripts from the internet though ...)

After this, the Bash version should be v3.2.54:

$ bash --version
GNU bash, version 3.2.54(1)-release (x86_64-apple-darwin13)
Copyright (C) 2007 Free Software Foundation, Inc.

For security, and after testing, I recommend that you chmod -x the old versions to ensure they aren't re-used, or move them to a backup site.

$ sudo chmod a-x /bin/bash.old /bin/sh.old

Other answers have solutions for those using MacPorts or Homebrew; these don't fix the problem, they just install additional versions of Bash. Please see those answers if you want to upgrade those specifically.

Thanks

Thanks to Chet, who looks after bash, and has been making these patches available. Thanks to everyone else who has commented on this and improved it over time.

Now Apple has released the real fix, though this might still be useful. Because they only released a fix for Lion and up, and the official patch provides GNU bash, version 3.2.53(1)-release (x86_64-apple-darwin13), however, the Game over bug is still vulnerable.