There’s a new vulnerability that impacts most Unix installs, including many embedded systems (devices that run Unix but don’t expose the OS interface) as well as OS X, the operating system at the heart of all modern Macs.
The issue is a flaw in the Bash shell that allows you to redefine a shell variable from the command line. To see this weakness in action, launch Terminal (it’s in Applications > Utilities) and type this line at the command prompt:
env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
If you are like most users, you’ll see this response when you hit return:
vulnerable
this is a test
This will impact anyone that exposes the Bash shell remotely, whether they do it themselves (to allow remote SSH connections, for example) or, more importantly, run an app that allows this to happen.
Bottom line, I suspect Apple is working on a patch to solve this and we’ll see a fix in the next OS X update. You can read all about this on the Red Hat blog post.
Paste in the above and you’ll get “-bash: syntax error near unexpected token `(‘”.
Sadly, this doesn’t mean you’re not vulnerable. It happens because this site’s blogging software is automatically adding curly quotes to the line of code.
This should work though:
env x='() { :;}; echo vulnerable' bash -c "echo this is a test"Keir, thanks for catching this. The blog automatically did the substitutions, so I hand inserted the HTML ASCII codes. Should be fixed now. — Dave
FYI… you can patch yourself instead of waiting for Apple. Here are instructions: http://apple.stackexchange.com/questions/146849/how-do-i-recompile-bash-to-avoid-the-remote-exploit-cve-2014-6271-and-cve-2014-7/146851#146851
Afterwards, you get this result:
bash: warning: x: ignoring function definition attempt
bash: error importing function definition for `x’
this is a test
I would love to see a list of applications/services that allow this exploit remotely. I tried to get it to work with the Apache2 server built into OS X but was unable to get it to work using curl and sending the bash environment in a http header. Does anyone know what other remote exploits are possible
so no it does NOT affect most installs of OS X because most users aren’t messing with command line etc and thus haven’t exposed the bash shell
show me that you can somehow do this on my computer without physical access and get into my stuff and then we can talk about impacts