September 2014

Protect Your System from the Shellshock Exploit

On Wednesday, the world learned about a bug in the popular Unix, Linux, and Mac OS X command line interpreter Bash.<br />

<a href="https://securityblog.redhat.com/2014/09/24/bash-specially-crafted-environment-variables-code-injection-attack/" rel="external nofollow" target="_blank">Discovered by engineers at Red Hat</a>,
 this bug is known as Shellshock, and allows an attacker to run commands
 in the Bash shell. Since the bug was announced, Bash has been updated 
for the major platforms it affects—so it’s pretty easy to update and 
protect systems.<br />

But there’s a problem: Bash is so widespread, and installed on so 
many devices—such as cable modems, routers, and other devices with 
embedded Linux operating systems—that it will be difficult, if not 
impossible, to fully patch everything that’s affected. (Windows users 
are generally unaffected by Shellshock, unless they’ve specifically 
installed Bash along with Cygwin, Git Bash, or other third-party 
packages.)<br />

And that’s what makes it so important to update and protect what you’re able to fix.<br />

A quick bit of test code has been making the rounds on the Internet, 
which lets you know whether the version of Bash you have installed is 
vulnerable to Shellshock. In particular, it contains a malformed 
environment function, in this case x:<br />

<pre class="line-numbers language-markup"><span style="background-color: lime;"><i><b><code class=" language-markup">env x='() { :;}; echo vulnerable' bash -c "echo done running"</code></b></i></span></pre>
Paste that into the command line on your system, being sure to get 
the quotes right: single quotes after “x=”, and also after “vulnerable”,
 and double quotes around “echo done running”. Make sure that your 
system hasn’t converted them to smart quotes.<br />

If your version of Bash is vulnerable, the shell will incorrectly 
interpret this environment function, and will execute the command after 
it—in this case, a very innocent ‘echo’ command that prints the word 
‘vulnerable’.<br />

And you can see that’s exactly what happened. An attacker could use 
similar code, but with a more malicious command or set of commands. This
 code could be delivered in various ways, such as through a CGI script 
on a web server.<br />

Now let’s take a look at how to fix it.<br />

<h2>
Updating Bash on Ubuntu / Debian</h2>
On Ubuntu, you’ll want to make sure to get the latest information from the update repositories:<br />

<pre class="line-numbers language-markup"><code class=" language-markup">sudo apt-get update</code></pre>
And then you’ll want to get the latest version of bash:<br />

<pre class="line-numbers language-markup"><span style="background-color: lime;"><i><b><code class=" language-markup">sudo apt-get install bash</code></b></i></span></pre>
<span style="background-color: lime;"><i><b>
</b></i></span>Next restart the system.<br />

You’ll then run the test code from earlier. Here I’ll do the same:<br />

In my example, you can see instead of ‘vulnerable’, I get some 
errors, where the updated version of Bash caught the error, and reacted 
correctly.<br />

<h2>
Updating Bash on CentOS / Red Hat</h2>
On CentOS, you’ll need to install the latest version of Bash:<br />

<pre class="line-numbers language-markup"><span style="background-color: lime;"><i><b><code class=" language-markup">sudo yum update bash</code></b></i></span></pre>
Then restart the system.<br />

After that, run the test code. It’s catching the problem now, instead of executing the code it shouldn’t be running:<br />

<h2>
Updating Bash on Mac OS X</h2>
On Mac OS X, the operation is a little bit more complicated. The Mac 
platform doesn’t have a package manager like apt or yum provided by 
Apple, so until Apple makes an update available, we need to either build
 an updated version of Bash from source, or use one of the third-party 
package managers that are available.<br />

<em><strong>Heads up:</strong></em> although I’ll step through how to
 update Bash using the command line below, I strongly recommend that you
 use any official patch Apple provides, when it becomes available. If 
you’re not a developer, or are unfamiliar with command line workflows, 
it’s probably in your best interest to wait until Apple makes a more 
automated patch available through the App Store.<br />

<h3>
Using the Homebrew Package Manager</h3>
First let’s take a look at updating Bash with the Homebrew package manager.<br />

Homebrew is a package manager, similar to apt or yum, which allows 
Mac users to install open-source packages from the command line. To 
install it, paste this line into your Terminal. Further information 
about HomeBrew is <a href="http://brew.sh/" rel="external nofollow">available on their website, at brew.sh</a>.<br />

<pre class="line-numbers language-markup"><span style="background-color: lime;"><i><b><code class=" language-markup">ruby -e "$(curl -fsSL <a class="token url-link" href="https://raw.githubusercontent.com/Homebrew/install/master/install">https://raw.githubusercontent.com/Homebrew/install/master/install</a>)"</code></b></i></span></pre>
Then, run:<br />

<pre class="line-numbers language-markup"><span style="background-color: lime;"><i><b><code class=" language-markup">brew doctor
brew update</code></b></i></span></pre>
And type:<br />

<pre class="line-numbers language-markup"><span style="background-color: lime;"><i><b><code class=" language-markup">brew upgrade bash</code></b></i></span></pre>
This will download and build the current version of Bash, and put it into a private folder: /usr/local/Cellar/bash/4.3.25/bin.<br />

You’ll need to replace your system’s copy of Bash with this version. First make a backup copy of the existing version:<br />

<pre class="line-numbers language-markup"><span style="background-color: lime;"><i><b><code class=" language-markup">sudo cp /bin/bash /bin/bash.previous</code></b></i></span></pre>
And make sure a clever attacker can’t easily run your backup copy:<br />

<pre class="line-numbers language-markup"><span style="background-color: lime;"><i><b><code class=" language-markup">sudo chmod a-x /bin/bash.previous</code></b></i></span></pre>
Then copy Brew’s version to your /bin folder:<br />
<span style="background-color: lime;"><i><b>
</b></i></span><pre class="line-numbers language-markup"><span style="background-color: lime;"><i><b><code class=" language-markup">sudo cp /usr/local/Cellar/bash/4.3.25/bin/bash /bin</code></b></i></span></pre>
And restart your system.<br />

Running the test code, I can see that this version of Bash is patched.<br />

<h3>
Building from source</h3>
Next let’s take a look at building Bash from source. To do this, 
you’ll need the Xcode developer tools, available from Apple. I’ll 
download the source code for Bash from Apple:<br />

<pre class="line-numbers language-markup"><span style="background-color: lime;"><i><b><code class=" language-markup">curl -O <a class="token url-link" href="https://opensource.apple.com/tarballs/bash/bash-92.tar.gz">https://opensource.apple.com/tarballs/bash/bash-92.tar.gz</a></code></b></i></span></pre>
Then unpack it:<br />

<pre class="line-numbers language-markup"><span style="background-color: lime;"><i><b><code class=" language-markup">tar zxf bash-92.tar.gz</code></b></i></span></pre>
Go into the source code folder:<br />
<span style="background-color: lime;"><i><b>
</b></i></span><pre class="line-numbers language-markup"><span style="background-color: lime;"><i><b><code class=" language-markup">cd bash-92
cd bash-3.2</code></b></i></span></pre>
After that, I’ll download the patched code from the GNU Foundation:<br />

<pre class="line-numbers language-markup"><span style="background-color: lime;"><i><b><code class=" language-markup">curl <a class="token url-link" href="https://ftp.gnu.org/pub/gnu/bash/bash-3.2-patches/bash32-052">https://ftp.gnu.org/pub/gnu/bash/bash-3.2-patches/bash32-052</a> | patch -p0</code></b></i></span></pre>
and I’ll pipe it to the patch command to apply the changes.<br />

I’ll move up a directory:<br />

<pre class="line-numbers language-markup"><span style="background-color: lime;"><i><b><code class=" language-markup">cd ..</code></b></i></span></pre>
Then I’ll use xcodebuild to build the source code:<br />

<pre class="line-numbers language-markup"><span style="background-color: lime;"><i><b><code class=" language-markup">sudo xcodebuild</code></b></i></span></pre>
<span style="background-color: lime;"><i><b>
</b></i></span>This leaves me with two executable files in the Release build folder: bash and sh:<br />
<span style="background-color: lime;"><i><b>
</b></i></span><pre class="line-numbers language-markup"><span style="background-color: lime;"><i><b><code class=" language-markup">cd build/Release
ls -lah</code></b></i></span></pre>
Now I’ll make backup copies of my existing versions of these, just in case:<br />

<pre class="line-numbers language-markup"><span style="background-color: lime;"><i><b><code class=" language-markup">sudo cp /bin/bash /bin/bash.previous
sudo cp /bin/sh /bin/sh.previous</code></b></i></span></pre>
And I’ll make them not executable:<br />

<pre class="line-numbers language-markup"><span style="background-color: lime;"><i><b><code class=" language-markup">sudo chmod a-x /bin/sh.previous /bin/bash.previous</code></b></i></span></pre>
Then replace the old versions with the patched versions:<br />
<span style="background-color: lime;"><i><b>
</b></i></span><pre class="line-numbers language-markup"><span style="background-color: lime;"><i><b><code class=" language-markup">sudo cp bash /bin
sudo cp sh /bin</code></b></i></span></pre>
I’ll restart the system.<br />

Now, when I run the test code, I can see that my version of Bash has been patched.<br />

Of course, you should also keep an eye out for, and install, any 
relevant firmware updates released by device vendors. Stay safe out 
there!<br />

<br />
UPDATE 5/26/2014
On September 26th, a second vulnerability in Bash was patched. This 
patch has been added to the RedHat and Ubuntu repositories, so if you 
patched your system before the 26th, you’ll need to do it again to get 
the patch for the second vulnerability. If you haven’t, just follow the 
steps for your Linux distribution listed below.<br />

The patch has not yet become available for Mac OS X, but Apple 
reports that they are working on a fix. Mac users, keep an eye out for a
 Security Update from Apple.<br />

You can test for this vulnerability by pasting this command into your terminal:<br />

<pre class="line-numbers language-markup"><span style="background-color: lime;"><i><b><code class=" language-markup">env X='() { (a)=>\' sh -c "echo date"; cat echo</code></b></i></span></pre>
If you see the current date and time, your system is vulnerable — the
 shell is interpreting the ‘echo date’ command incorrectly (it should 
return ‘date’) but instead it’s running date as a command. It’s innocent
 in this example, but could be replaced with a malicious command by a 
less-than-ethical attacker:<br />

If you don’t see the current date and time, your system has a patched version of the shell:<br />

Protect Your System from the Shellshock Exploit

On Wednesday, the world learned about a bug in the popular Unix, Linux, and Mac OS X command line interpreter Bash. Discovered by engin...

Every Mac Is Vulnerable to the Shellshock Bash Exploit: Here's How to Patch OS X

<div dir="ltr" style="text-align: left;" trbidi="on">
Heartbleed,
 move over. There's a new bug in town, and this time it's also affecting
 Mac and Linux computers. It's called Shellshock (its original official 
title is CVE-2014-6271), and it's currently got a 10 out of 10 severity 
rating over at the <a href="http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-6271" rel="nofollow" target="_blank">National Cyber Awareness System</a>. While some updates have been issued to fix this bug, they were <a href="http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-7169" rel="nofollow" target="_blank">incomplete</a>, and your system is probably still vulnerable, as it has been for the last <a href="http://www.nydailynews.com/news/national/shellshock-bug-threatens-mac-linux-computers-article-1.1952516" rel="nofollow" target="_blank">probably 20 years</a>.<br />

<section>
<h2 class="sectionHeadline">
UPDATE 9/26/2014</h2>
A new patch addresses an additional attack vector known as <a href="http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-7169" rel="nofollow" target="_blank">CVE-2014-7169</a>.<br />
If you followed these instructions before 3:10 p.m. PDT on Friday, September 26th, 2014, please delete your <strong>bash-fix</strong> directory (you can find it in <strong>Users</strong> -> <strong>Username</strong>
 via the Finder) and follow all the steps below again (starting with 
Step #1) to ensure that your system is fully patched. If you did not 
already update manually, the <em>do not</em> delete the bash-fix directory.<br />
The instructions now fully address both vulnerabilities and should be the last patch you need to perform.</section>
<section>
<h2 class="sectionHeadline">
What Is Bash?</h2>
Bash is a command-line 
shell used in many Linux- and Unix-based operating systems, including 
Mac OS X. If bash is the default system shell on your computer, it can 
be used by remote hackers for network-based attacks. With a simple script,
 a hacker can launch programs or enable features on your computer 
without any passwords needed and without your knowledge. They could 
access your files, copy confidential information, delete data, run 
programs, and more.<br />
While the likelihood of your personal Mac 
being targeted by an attack is relatively small, it's still a big issue 
that will hopefully get a real and working patch soon. Until then, there
 are a few things you can do.</section>
<section>
<h2 class="sectionHeadline">
Testing for Vulnerability #1</h2>
In a 
Terminal window, type in the following command into the shell, followed 
by the Enter key. Terminal can be found in Utilities in your 
Applications folders, or via a quick Spotlight search.<br />
<ul>
<li><em>env x='() { :;}; echo vulnerable' bash -c "echo this is a test"</em></li>
</ul>
</section>
<section>
<h2 class="sectionHeadline">
The Good Result</h2>
If your system is not vulnerable to the Shellshock bug, it will return something similar to the below output.<br />
<em>bash: warning: x: ignoring function definition attempt</em><br /><em>bash: error importing function definition for `x'</em><br /><em>this is a test</em></section>
<section>
<h2 class="sectionHeadline">
The Bad Result</h2>
If your system is indeed vulnerable to Shellshock, you'll see the following instead.<br />
<em><strong>vulnerable</strong></em><br /><em>this is a test</em><br />
 <figure class="whtGallery" id="37866602docPartGal880013" role="group"><div class="gallery-layout" style="height: 133px; overflow: visible;">
   <div class="gallery-layout-container">
<figure class="gal-row gal-row-f gal-wa img-shadow" data-index="0" style="width: 532px;"><a href="http://img.wonderhowto.com/img/original/44/79/63547241843450/0/635472418434504479.jpg" rel="nofollow" target="_blank"><img alt="" src="http://img.wonderhowto.com/img/44/79/63547241843450/0/every-mac-is-vulnerable-shellshock-bash-exploit-heres-patch-os-x.w654.jpg" style="height: 133px; max-width: 532px; width: auto;" /></a></figure></div>
</div>
</figure> </section>
<section>
<h2 class="sectionHeadline">
Testing for Vulnerability #2 (Added 9/26/2014)</h2>
If
 you pass the first test, use the following test to see if you're 
vulnerable from the second attack vector, which was discovered on 
Thursday.<br />
<ul>
<li><em>env X='(){(a)=>\' bash -c "echo date"; cat echo; rm -f echo</em></li>
</ul>
</section>
<section>
<h2 class="sectionHeadline">
The Good Result</h2>
If your system is fine, you'll see something like the following (without any printout of the current date and time).<br />
<em>date</em><br /><em>cat: echo: No such file or directory</em></section>
<section>
<h2 class="sectionHeadline">
The Bad Result</h2>
If your system is indeed vulnerable to the second attack vector, you'll see the following instead.<br />
<em>date</em><br /><em><The Current Date and Time></em><br />
 <figure class="whtGallery" id="10912700docPartGal880021" role="group"><div class="gallery-layout" style="height: 326px; overflow: visible;">
   <div class="gallery-layout-container">
<figure class="gal-row gal-row-f gal-wa img-shadow" data-index="0" style="width: 532px;"><a href="http://img.wonderhowto.com/img/original/36/81/63547344478120/0/635473444781203681.jpg" rel="nofollow" target="_blank"><img alt="" src="http://img.wonderhowto.com/img/36/81/63547344478120/0/every-mac-is-vulnerable-shellshock-bash-exploit-heres-patch-os-x.w654.jpg" style="height: 326px; margin-left: 0px; max-width: 532px; width: auto;" /></a></figure></div>
</div>
</figure> </section>
<section>
<h2 class="sectionHeadline">
Is There an Update Yet?</h2>
Many Linux distros have already released patches for Shellshock (though they were mostly <a href="https://access.redhat.com/articles/1200223" rel="nofollow" target="_blank">incomplete</a>), but Mac OS X has not received anything yet, and Apple hasn't even commented on the issue. There was a <a href="http://support.apple.com/kb/HT6400" rel="nofollow" target="_blank">recent 10.9.5 update</a> for Mavericks, but it has nothing pertaining to this issue.<br />
If you're worried, though, there is a way to manually update your GNU bash version to a more secure one, thanks to <a href="http://apple.stackexchange.com/questions/146849/how-do-i-recompile-bash-to-avoid-the-remote-exploit-cve-2014-6271-and-cve-2014-7/" rel="nofollow" target="_blank">some users over at StackExchange</a>.</section>
<section>
<h2 class="sectionHeadline">
Check Your Current Bash Version</h2>
To 
see what version bash you have installed on your Mac, in a Terminal 
window, enter the following command (followed by the Enter key) into the
 shell.<br />
<ul>
<li><em>bash --version</em></li>
</ul>
If you get <strong>GNU bash, version 3.2.51(1)-release</strong>, then you'll want to manually update to the newest version of bash 3.2, which is <strong>3.2.53</strong>. Also, if you've already used this guide to update to <strong>3.2.52(1)-release</strong>, then you'll want to perform everything below again to make sure you're fully protected.<br />
There
 are newer versions of bash out there, but Mac OS X runs off the 3.2 
branch. If you're using Linux, you'll want to make sure the patch you 
download matches the version of bash you're using. The latest patches 
for all major versions of bash (including 3.0, 3.1, 3.2, 4.0, 4.1, 4.2, 
and 4.3) can be found <a href="https://ftp.gnu.org/pub/gnu/bash/" rel="nofollow" target="_blank">here</a>.</section>
<section>
<h2 class="sectionHeadline">
Manually Updating Bash - Initial Requirements</h2>
You can manually compile the newest bash version (3.2.53) using the below instructions, but you have to have <a href="https://developer.apple.com/xcode/downloads/" rel="nofollow" target="_blank">Apple's Xcode</a> installed on your Mac for this to work. If you don't have it, follow the instructions in the Prerequisite Check section below.<br />
If you don't want to update bash, there is <a href="https://access.redhat.com/articles/1200223" rel="nofollow" target="_blank">a workaround provided by Red Hat</a>, but it hasn't been tested fully, so I wouldn't recommend it.</section>
<section>
<h2 class="sectionHeadline">
Prerequisite Check</h2>
You'll need to 
make sure you have Xcode installed, and have agreed to Apple's terms. 
For older Macs, you'll also need to make sure you have all the command 
line tools.<br />
You can download Xcode for free from the <a href="https://itunes.apple.com/us/app/xcode/id497799835?mt=12" rel="nofollow" target="_blank">Mac App Store</a>.<br />
If
 you're on an older version of Mac OS X and Xcode isn't available for 
you in the Mac App Store, you can download older versions by searching 
for the proper version number after logging into Apple's developer 
portal <a href="https://developer.apple.com/downloads/index.action" rel="nofollow" target="_blank">here</a>
 with your Apple ID. If you're on Mac OS X 10.7 or 10.8, search for 
"Xcode 4.6.3" in the Downloads for Apple Developers search box on the 
left side of the page.<br />
Once you've installed Xcode, launch it from
 your Applications folder and agree to Apple's license agreement (the 
initial launch may take a while). After that, you'll want to confirm 
that you have all of the command line tools. To do so, do the following:<br />
<ol>
<li>With Xcode open, click the <strong>Xcode</strong> menu in your top menu bar.</li>
<li>Click <strong>Preferences</strong>.</li>
<li>Click the <strong>Downloads</strong> tab.</li>
<li>Click <strong>Install</strong> next to the <strong>Command Line Tools</strong> in the list of downloads.</li>
</ol>
<strong>Note:</strong> If you don't see "Command Line Tools" in the downloads tab, then that means you've already got them and are ready to go!<br />
Once done, you have everything you need to patch your system.</section>
<section>
<h2 class="step">
Step 1: Download & Compile the Patch</h2>
Once 
you've confirmed you have Xcode installed, open Terminal again and enter
 the following commands. Each bullet point is one command, so make sure 
you copy the full line in each bullet point (minus the bullet, of 
course).<br />
<ul>
<li><em>mkdir bash-fix</em></li>
<li><em>cd bash-fix</em></li>
<li><em>curl <a href="https://opensource.apple.com/tarballs/bash/bash-92.tar.gz" rel="nofollow" target="_blank">https://opensource.apple.com/tarballs/bash/bash-92.tar.gz</a> | tar zxf -</em></li>
<li><em>cd bash-92/bash-3.2</em></li>
<li><em>curl <a href="https://ftp.gnu.org/pub/gnu/bash/bash-3.2-patches/bash32-052" rel="nofollow" target="_blank">https://ftp.gnu.org/pub/gnu/bash/bash-3.2-patches/bash32-052</a> | patch -p0</em></li>
<li><em>cd ..</em></li>
<li><em>xcodebuild</em></li>
</ul>
<figure class="whtGallery" id="18044166docPartGal880033" role="group"><div class="gallery-layout" style="height: 251px; overflow: visible;">
   <div class="gallery-layout-container">
<figure class="gal-row gal-row-f gal-wa img-shadow" data-index="0" style="width: 532px;"><a href="http://img.wonderhowto.com/img/original/87/88/63547241998809/0/635472419988098788.jpg" rel="nofollow" target="_blank"><img alt="" src="http://img.wonderhowto.com/img/87/88/63547241998809/0/every-mac-is-vulnerable-shellshock-bash-exploit-heres-patch-os-x.w654.jpg" style="height: 251px; margin-left: 0px; max-width: 532px; width: auto;" /></a></figure></div>
</div>
</figure> This
 process may take a while, and you'll see a lot of text appearing in the
 Terminal window. It's just Xcode compiling the new version of bash on 
your system. Once it's done, it'll say “BUILD SUCCEEDED” and you'll see a
 Terminal prompt again.<br />
 <figure class="whtGallery" id="21884545docPartGal880035" role="group"><div class="gallery-layout" style="height: 276px; overflow: visible;">
   <div class="gallery-layout-container">
<figure class="gal-row gal-row-f gal-wa img-shadow" data-index="0" style="width: 532px;"><a href="http://img.wonderhowto.com/img/original/93/79/63547242299762/0/635472422997629379.jpg" rel="nofollow" target="_blank"><img alt="" src="http://img.wonderhowto.com/img/93/79/63547242299762/0/every-mac-is-vulnerable-shellshock-bash-exploit-heres-patch-os-x.w654.jpg" style="height: 276px; margin-left: 0px; max-width: 532px; width: auto;" /></a></figure></div>
</div>
</figure> </section>
<section>
<h2 class="step">
Step 2: Download, Compile, & Build the Second Patch</h2>
This
 step was added on 9/26/2014 at 3:10 p.m. PDT to address the second 
vulnerability. Please see the "UPDATE" section at the top of this 
article for more information.<br />
<ul>
<li><em>mv build/bash.build/Release/bash.build/DerivedSources/y.tab.* bash-3.2/</em></li>
<li><em>cd bash-3.2</em></li>
<li><em>curl <a href="https://ftp.gnu.org/pub/gnu/bash/bash-3.2-patches/bash32-053" rel="nofollow" target="_blank">https://ftp.gnu.org/pub/gnu/bash/bash-3.2-patches/bash32-053</a> | patch -p0</em></li>
<li><em>cd ..</em></li>
<li><em>xcodebuild</em></li>
</ul>
Again, you'll see “BUILD SUCCEEDED” when done.<br />
 <figure class="whtGallery" id="39459550docPartGal880039" role="group"><div class="gallery-layout" style="height: 325px; overflow: visible;">
   <div class="gallery-layout-container">
<figure class="gal-row gal-row-f gal-wa img-shadow" data-index="0" style="width: 532px;"><a href="http://img.wonderhowto.com/img/original/19/19/63547345047292/0/635473450472921919.jpg" rel="nofollow" target="_blank"><img alt="" src="http://img.wonderhowto.com/img/19/19/63547345047292/0/every-mac-is-vulnerable-shellshock-bash-exploit-heres-patch-os-x.w654.jpg" style="height: 325px; margin-left: 0px; max-width: 532px; width: auto;" /></a></figure></div>
</div>
</figure> </section>
<section>
<h2 class="step">
Step 3: Back Up Your Current Version (Just in Case)</h2>
Just
 in case something goes wrong, it's a good idea to back up your current 
version of bash. You can do so by entering the following two commands in
 Terminal.<br />
Note that you'll likely be prompted for a password when
 doing this step. If so, use the same password you use to log in to your
 Mac. You will not see your password in Terminal as you type, so it may 
take you few attempts if you have a complicated password.<br />
<ul>
<li><em>sudo cp /bin/bash /bin/bash.old</em></li>
<li><em>sudo cp /bin/sh /bin/sh.old</em></li>
</ul>
You won't see any confirmation, but it'll work, and if something goes wrong after Step #5 below, you can get back your old <em>un-patched</em>
 version of bash by reversing the above copy commands, to copy the 
".old" copies back over their original files (without the ".old" part).</section>
<section>
<h2 class="step">
Step 4: Verify the Version of Your New Build</h2>
Enter the following commands in Terminal to verify you've got the new version of the bash build on your computer.<br />
<ul>
<li><em>build/Release/bash --version</em></li>
<li><em>build/Release/sh --version</em></li>
</ul>
The output of these commands should confirm for you that the build version of bash is <strong>3.2.53(1)-release</strong>.</section>
<section>
<h2 class="step">
Step 5: Replace Your Old Bash with the Patched Version</h2>
Almost done. You just have to copy the new version of bash over your old version. Do so with the following Terminal commands.<br />
<ul>
<li><em>sudo cp build/Release/bash /bin</em></li>
<li><em>sudo cp build/Release/sh /bin</em></li>
</ul>
And
 that's it. Now just try out the test again and if it comes back with 
the good result (i.e., not the one that says "vulnerable"), then you're 
golden.<br />
<ul>
<li><em>env x='() { :;}; echo vulnerable' bash -c "echo this is a test"</em></li>
</ul>
And run the second test to confirm the current date and time don't print out:<br />
<ul>
<li><em>env X='(){(a)=>\' bash -c "echo date"; cat echo; rm -f echo</em></li>
</ul>
<figure class="whtGallery" id="34601862docPartGal880047" role="group"><div class="gallery-layout" style="height: 326px; overflow: visible;">
   <div class="gallery-layout-container">
<figure class="gal-row gal-row-f gal-wa img-shadow" data-index="0" style="width: 532px;"><a href="http://img.wonderhowto.com/img/original/20/31/63547345135339/0/635473451353392031.jpg" rel="nofollow" target="_blank"><img alt="" src="http://img.wonderhowto.com/img/20/31/63547345135339/0/every-mac-is-vulnerable-shellshock-bash-exploit-heres-patch-os-x.w654.jpg" style="height: 326px; margin-left: 0px; max-width: 532px; width: auto;" /></a></figure></div>
</div>
</figure> If
 the date does print out again, first check your user home directory to 
see if a file called "echo" was created when you ran the test the first 
time. If so, delete it and run the test again. If the date still prints 
out, chances are you missed part of the <em>new</em> Step #2 above. If 
you ever think you might of messed up a command, you can always start 
over by deleting your bash-fix folder and starting again from Step #1. 
Also note that you can delete the bash-fix folder if you're all good, 
too, because it's just a temporary folder.</section>
<section>
<h2 class="sectionHeadline">
For Homebrew or Macports Users</h2>
If you use Homebrew or Macports, you can get <a href="http://apple.stackexchange.com/questions/146849/how-do-i-recompile-bash-to-avoid-the-remote-exploit-cve-2014-6271-and-cve-2014-7/" rel="nofollow" target="_blank">instructions on updating bash</a> over at StackExchange.<br />
 
            </section></div>

Every Mac Is Vulnerable to the Shellshock Bash Exploit: Here's How to Patch OS X

Heartbleed, move over. There's a new bug in town, and this time it's also affecting Mac and Linux computers. It's called Shel...