1769

<div dir="ltr" style="text-align: left;" trbidi="on">
Heartbleed,
 move over. There's a new bug in town, and this time it's also affecting
 Mac and Linux computers. It's called Shellshock (its original official 
title is CVE-2014-6271), and it's currently got a 10 out of 10 severity 
rating over at the <a href="http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-6271" rel="nofollow" target="_blank">National Cyber Awareness System</a>. While some updates have been issued to fix this bug, they were <a href="http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-7169" rel="nofollow" target="_blank">incomplete</a>, and your system is probably still vulnerable, as it has been for the last <a href="http://www.nydailynews.com/news/national/shellshock-bug-threatens-mac-linux-computers-article-1.1952516" rel="nofollow" target="_blank">probably 20 years</a>.<br />

<section>
<h2 class="sectionHeadline">
UPDATE 9/26/2014</h2>
A new patch addresses an additional attack vector known as <a href="http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-7169" rel="nofollow" target="_blank">CVE-2014-7169</a>.<br />
If you followed these instructions before 3:10 p.m. PDT on Friday, September 26th, 2014, please delete your <strong>bash-fix</strong> directory (you can find it in <strong>Users</strong> -> <strong>Username</strong>
 via the Finder) and follow all the steps below again (starting with 
Step #1) to ensure that your system is fully patched. If you did not 
already update manually, the <em>do not</em> delete the bash-fix directory.<br />
The instructions now fully address both vulnerabilities and should be the last patch you need to perform.</section>
<section>
<h2 class="sectionHeadline">
What Is Bash?</h2>
Bash is a command-line 
shell used in many Linux- and Unix-based operating systems, including 
Mac OS X. If bash is the default system shell on your computer, it can 
be used by remote hackers for network-based attacks. With a simple script,
 a hacker can launch programs or enable features on your computer 
without any passwords needed and without your knowledge. They could 
access your files, copy confidential information, delete data, run 
programs, and more.<br />
While the likelihood of your personal Mac 
being targeted by an attack is relatively small, it's still a big issue 
that will hopefully get a real and working patch soon. Until then, there
 are a few things you can do.</section>
<section>
<h2 class="sectionHeadline">
Testing for Vulnerability #1</h2>
In a 
Terminal window, type in the following command into the shell, followed 
by the Enter key. Terminal can be found in Utilities in your 
Applications folders, or via a quick Spotlight search.<br />
<ul>
<li><em>env x='() { :;}; echo vulnerable' bash -c "echo this is a test"</em></li>
</ul>
</section>
<section>
<h2 class="sectionHeadline">
The Good Result</h2>
If your system is not vulnerable to the Shellshock bug, it will return something similar to the below output.<br />
<em>bash: warning: x: ignoring function definition attempt</em><br /><em>bash: error importing function definition for `x'</em><br /><em>this is a test</em></section>
<section>
<h2 class="sectionHeadline">
The Bad Result</h2>
If your system is indeed vulnerable to Shellshock, you'll see the following instead.<br />
<em><strong>vulnerable</strong></em><br /><em>this is a test</em><br />
 <figure class="whtGallery" id="37866602docPartGal880013" role="group"><div class="gallery-layout" style="height: 133px; overflow: visible;">
   <div class="gallery-layout-container">
<figure class="gal-row gal-row-f gal-wa img-shadow" data-index="0" style="width: 532px;"><a href="http://img.wonderhowto.com/img/original/44/79/63547241843450/0/635472418434504479.jpg" rel="nofollow" target="_blank"><img alt="" src="http://img.wonderhowto.com/img/44/79/63547241843450/0/every-mac-is-vulnerable-shellshock-bash-exploit-heres-patch-os-x.w654.jpg" style="height: 133px; max-width: 532px; width: auto;" /></a></figure></div>
</div>
</figure> </section>
<section>
<h2 class="sectionHeadline">
Testing for Vulnerability #2 (Added 9/26/2014)</h2>
If
 you pass the first test, use the following test to see if you're 
vulnerable from the second attack vector, which was discovered on 
Thursday.<br />
<ul>
<li><em>env X='(){(a)=>\' bash -c "echo date"; cat echo; rm -f echo</em></li>
</ul>
</section>
<section>
<h2 class="sectionHeadline">
The Good Result</h2>
If your system is fine, you'll see something like the following (without any printout of the current date and time).<br />
<em>date</em><br /><em>cat: echo: No such file or directory</em></section>
<section>
<h2 class="sectionHeadline">
The Bad Result</h2>
If your system is indeed vulnerable to the second attack vector, you'll see the following instead.<br />
<em>date</em><br /><em><The Current Date and Time></em><br />
 <figure class="whtGallery" id="10912700docPartGal880021" role="group"><div class="gallery-layout" style="height: 326px; overflow: visible;">
   <div class="gallery-layout-container">
<figure class="gal-row gal-row-f gal-wa img-shadow" data-index="0" style="width: 532px;"><a href="http://img.wonderhowto.com/img/original/36/81/63547344478120/0/635473444781203681.jpg" rel="nofollow" target="_blank"><img alt="" src="http://img.wonderhowto.com/img/36/81/63547344478120/0/every-mac-is-vulnerable-shellshock-bash-exploit-heres-patch-os-x.w654.jpg" style="height: 326px; margin-left: 0px; max-width: 532px; width: auto;" /></a></figure></div>
</div>
</figure> </section>
<section>
<h2 class="sectionHeadline">
Is There an Update Yet?</h2>
Many Linux distros have already released patches for Shellshock (though they were mostly <a href="https://access.redhat.com/articles/1200223" rel="nofollow" target="_blank">incomplete</a>), but Mac OS X has not received anything yet, and Apple hasn't even commented on the issue. There was a <a href="http://support.apple.com/kb/HT6400" rel="nofollow" target="_blank">recent 10.9.5 update</a> for Mavericks, but it has nothing pertaining to this issue.<br />
If you're worried, though, there is a way to manually update your GNU bash version to a more secure one, thanks to <a href="http://apple.stackexchange.com/questions/146849/how-do-i-recompile-bash-to-avoid-the-remote-exploit-cve-2014-6271-and-cve-2014-7/" rel="nofollow" target="_blank">some users over at StackExchange</a>.</section>
<section>
<h2 class="sectionHeadline">
Check Your Current Bash Version</h2>
To 
see what version bash you have installed on your Mac, in a Terminal 
window, enter the following command (followed by the Enter key) into the
 shell.<br />
<ul>
<li><em>bash --version</em></li>
</ul>
If you get <strong>GNU bash, version 3.2.51(1)-release</strong>, then you'll want to manually update to the newest version of bash 3.2, which is <strong>3.2.53</strong>. Also, if you've already used this guide to update to <strong>3.2.52(1)-release</strong>, then you'll want to perform everything below again to make sure you're fully protected.<br />
There
 are newer versions of bash out there, but Mac OS X runs off the 3.2 
branch. If you're using Linux, you'll want to make sure the patch you 
download matches the version of bash you're using. The latest patches 
for all major versions of bash (including 3.0, 3.1, 3.2, 4.0, 4.1, 4.2, 
and 4.3) can be found <a href="https://ftp.gnu.org/pub/gnu/bash/" rel="nofollow" target="_blank">here</a>.</section>
<section>
<h2 class="sectionHeadline">
Manually Updating Bash - Initial Requirements</h2>
You can manually compile the newest bash version (3.2.53) using the below instructions, but you have to have <a href="https://developer.apple.com/xcode/downloads/" rel="nofollow" target="_blank">Apple's Xcode</a> installed on your Mac for this to work. If you don't have it, follow the instructions in the Prerequisite Check section below.<br />
If you don't want to update bash, there is <a href="https://access.redhat.com/articles/1200223" rel="nofollow" target="_blank">a workaround provided by Red Hat</a>, but it hasn't been tested fully, so I wouldn't recommend it.</section>
<section>
<h2 class="sectionHeadline">
Prerequisite Check</h2>
You'll need to 
make sure you have Xcode installed, and have agreed to Apple's terms. 
For older Macs, you'll also need to make sure you have all the command 
line tools.<br />
You can download Xcode for free from the <a href="https://itunes.apple.com/us/app/xcode/id497799835?mt=12" rel="nofollow" target="_blank">Mac App Store</a>.<br />
If
 you're on an older version of Mac OS X and Xcode isn't available for 
you in the Mac App Store, you can download older versions by searching 
for the proper version number after logging into Apple's developer 
portal <a href="https://developer.apple.com/downloads/index.action" rel="nofollow" target="_blank">here</a>
 with your Apple ID. If you're on Mac OS X 10.7 or 10.8, search for 
"Xcode 4.6.3" in the Downloads for Apple Developers search box on the 
left side of the page.<br />
Once you've installed Xcode, launch it from
 your Applications folder and agree to Apple's license agreement (the 
initial launch may take a while). After that, you'll want to confirm 
that you have all of the command line tools. To do so, do the following:<br />
<ol>
<li>With Xcode open, click the <strong>Xcode</strong> menu in your top menu bar.</li>
<li>Click <strong>Preferences</strong>.</li>
<li>Click the <strong>Downloads</strong> tab.</li>
<li>Click <strong>Install</strong> next to the <strong>Command Line Tools</strong> in the list of downloads.</li>
</ol>
<strong>Note:</strong> If you don't see "Command Line Tools" in the downloads tab, then that means you've already got them and are ready to go!<br />
Once done, you have everything you need to patch your system.</section>
<section>
<h2 class="step">
Step 1: Download & Compile the Patch</h2>
Once 
you've confirmed you have Xcode installed, open Terminal again and enter
 the following commands. Each bullet point is one command, so make sure 
you copy the full line in each bullet point (minus the bullet, of 
course).<br />
<ul>
<li><em>mkdir bash-fix</em></li>
<li><em>cd bash-fix</em></li>
<li><em>curl <a href="https://opensource.apple.com/tarballs/bash/bash-92.tar.gz" rel="nofollow" target="_blank">https://opensource.apple.com/tarballs/bash/bash-92.tar.gz</a> | tar zxf -</em></li>
<li><em>cd bash-92/bash-3.2</em></li>
<li><em>curl <a href="https://ftp.gnu.org/pub/gnu/bash/bash-3.2-patches/bash32-052" rel="nofollow" target="_blank">https://ftp.gnu.org/pub/gnu/bash/bash-3.2-patches/bash32-052</a> | patch -p0</em></li>
<li><em>cd ..</em></li>
<li><em>xcodebuild</em></li>
</ul>
<figure class="whtGallery" id="18044166docPartGal880033" role="group"><div class="gallery-layout" style="height: 251px; overflow: visible;">
   <div class="gallery-layout-container">
<figure class="gal-row gal-row-f gal-wa img-shadow" data-index="0" style="width: 532px;"><a href="http://img.wonderhowto.com/img/original/87/88/63547241998809/0/635472419988098788.jpg" rel="nofollow" target="_blank"><img alt="" src="http://img.wonderhowto.com/img/87/88/63547241998809/0/every-mac-is-vulnerable-shellshock-bash-exploit-heres-patch-os-x.w654.jpg" style="height: 251px; margin-left: 0px; max-width: 532px; width: auto;" /></a></figure></div>
</div>
</figure> This
 process may take a while, and you'll see a lot of text appearing in the
 Terminal window. It's just Xcode compiling the new version of bash on 
your system. Once it's done, it'll say “BUILD SUCCEEDED” and you'll see a
 Terminal prompt again.<br />
 <figure class="whtGallery" id="21884545docPartGal880035" role="group"><div class="gallery-layout" style="height: 276px; overflow: visible;">
   <div class="gallery-layout-container">
<figure class="gal-row gal-row-f gal-wa img-shadow" data-index="0" style="width: 532px;"><a href="http://img.wonderhowto.com/img/original/93/79/63547242299762/0/635472422997629379.jpg" rel="nofollow" target="_blank"><img alt="" src="http://img.wonderhowto.com/img/93/79/63547242299762/0/every-mac-is-vulnerable-shellshock-bash-exploit-heres-patch-os-x.w654.jpg" style="height: 276px; margin-left: 0px; max-width: 532px; width: auto;" /></a></figure></div>
</div>
</figure> </section>
<section>
<h2 class="step">
Step 2: Download, Compile, & Build the Second Patch</h2>
This
 step was added on 9/26/2014 at 3:10 p.m. PDT to address the second 
vulnerability. Please see the "UPDATE" section at the top of this 
article for more information.<br />
<ul>
<li><em>mv build/bash.build/Release/bash.build/DerivedSources/y.tab.* bash-3.2/</em></li>
<li><em>cd bash-3.2</em></li>
<li><em>curl <a href="https://ftp.gnu.org/pub/gnu/bash/bash-3.2-patches/bash32-053" rel="nofollow" target="_blank">https://ftp.gnu.org/pub/gnu/bash/bash-3.2-patches/bash32-053</a> | patch -p0</em></li>
<li><em>cd ..</em></li>
<li><em>xcodebuild</em></li>
</ul>
Again, you'll see “BUILD SUCCEEDED” when done.<br />
 <figure class="whtGallery" id="39459550docPartGal880039" role="group"><div class="gallery-layout" style="height: 325px; overflow: visible;">
   <div class="gallery-layout-container">
<figure class="gal-row gal-row-f gal-wa img-shadow" data-index="0" style="width: 532px;"><a href="http://img.wonderhowto.com/img/original/19/19/63547345047292/0/635473450472921919.jpg" rel="nofollow" target="_blank"><img alt="" src="http://img.wonderhowto.com/img/19/19/63547345047292/0/every-mac-is-vulnerable-shellshock-bash-exploit-heres-patch-os-x.w654.jpg" style="height: 325px; margin-left: 0px; max-width: 532px; width: auto;" /></a></figure></div>
</div>
</figure> </section>
<section>
<h2 class="step">
Step 3: Back Up Your Current Version (Just in Case)</h2>
Just
 in case something goes wrong, it's a good idea to back up your current 
version of bash. You can do so by entering the following two commands in
 Terminal.<br />
Note that you'll likely be prompted for a password when
 doing this step. If so, use the same password you use to log in to your
 Mac. You will not see your password in Terminal as you type, so it may 
take you few attempts if you have a complicated password.<br />
<ul>
<li><em>sudo cp /bin/bash /bin/bash.old</em></li>
<li><em>sudo cp /bin/sh /bin/sh.old</em></li>
</ul>
You won't see any confirmation, but it'll work, and if something goes wrong after Step #5 below, you can get back your old <em>un-patched</em>
 version of bash by reversing the above copy commands, to copy the 
".old" copies back over their original files (without the ".old" part).</section>
<section>
<h2 class="step">
Step 4: Verify the Version of Your New Build</h2>
Enter the following commands in Terminal to verify you've got the new version of the bash build on your computer.<br />
<ul>
<li><em>build/Release/bash --version</em></li>
<li><em>build/Release/sh --version</em></li>
</ul>
The output of these commands should confirm for you that the build version of bash is <strong>3.2.53(1)-release</strong>.</section>
<section>
<h2 class="step">
Step 5: Replace Your Old Bash with the Patched Version</h2>
Almost done. You just have to copy the new version of bash over your old version. Do so with the following Terminal commands.<br />
<ul>
<li><em>sudo cp build/Release/bash /bin</em></li>
<li><em>sudo cp build/Release/sh /bin</em></li>
</ul>
And
 that's it. Now just try out the test again and if it comes back with 
the good result (i.e., not the one that says "vulnerable"), then you're 
golden.<br />
<ul>
<li><em>env x='() { :;}; echo vulnerable' bash -c "echo this is a test"</em></li>
</ul>
And run the second test to confirm the current date and time don't print out:<br />
<ul>
<li><em>env X='(){(a)=>\' bash -c "echo date"; cat echo; rm -f echo</em></li>
</ul>
<figure class="whtGallery" id="34601862docPartGal880047" role="group"><div class="gallery-layout" style="height: 326px; overflow: visible;">
   <div class="gallery-layout-container">
<figure class="gal-row gal-row-f gal-wa img-shadow" data-index="0" style="width: 532px;"><a href="http://img.wonderhowto.com/img/original/20/31/63547345135339/0/635473451353392031.jpg" rel="nofollow" target="_blank"><img alt="" src="http://img.wonderhowto.com/img/20/31/63547345135339/0/every-mac-is-vulnerable-shellshock-bash-exploit-heres-patch-os-x.w654.jpg" style="height: 326px; margin-left: 0px; max-width: 532px; width: auto;" /></a></figure></div>
</div>
</figure> If
 the date does print out again, first check your user home directory to 
see if a file called "echo" was created when you ran the test the first 
time. If so, delete it and run the test again. If the date still prints 
out, chances are you missed part of the <em>new</em> Step #2 above. If 
you ever think you might of messed up a command, you can always start 
over by deleting your bash-fix folder and starting again from Step #1. 
Also note that you can delete the bash-fix folder if you're all good, 
too, because it's just a temporary folder.</section>
<section>
<h2 class="sectionHeadline">
For Homebrew or Macports Users</h2>
If you use Homebrew or Macports, you can get <a href="http://apple.stackexchange.com/questions/146849/how-do-i-recompile-bash-to-avoid-the-remote-exploit-cve-2014-6271-and-cve-2014-7/" rel="nofollow" target="_blank">instructions on updating bash</a> over at StackExchange.<br />
 
            </section></div>

Every Mac Is Vulnerable to the Shellshock Bash Exploit: Here's How to Patch OS X

Heartbleed, move over. There's a new bug in town, and this time it's also affecting Mac and Linux computers. It's called Shel...