Bash remote vulnerability

[ginggs]

http://alblue.bandlem.com/2014/09/bash-remote-vulnerability.html

As you’ve probably heard, there’s a remote vulnerability in Bash, which means that an attacker can supply a malicious code by virtue of passing in an environment variable with a specially crafted value that is then executed by Bash when a new shell starts up. This could potentially give an attacker control over an account running requests, which could include any HTTP request (variables such as REMOTE_HOST are passed through to CGI scripts by default) as well as certain environment variables in SSH (such as TERM).

I have written about this more at InfoQ, and most major operating system vendors have published updates to their versions of Bash.

Apple typically take time to fix these issues, so in the meantime, if you have an OSX server estate you are advised to upgrade to a new version of bash immediately.

If you have the Xcode developer tools available, you can compile it yourself as follows:

 

[GreGorGy]

Mod please move - this is Mac OS X not some linux rubbish





Thanks for the link Ginggs. I have two servers I may need to take action with - depending on what plans their owners have for their futures. They are in the process of retiring them (OS X 10.5, so a few years old now).

 

[MagicDude4Eva]

Does this bash thing also apply if you do not have an AppleTV or Apple remote? Clicking on the geek link above got me this error:

 

[creeper]

Does this bash thing also apply if you do not have an AppleTV or Apple remote? Clicking on the geek link above got me this error:

View attachment 152628

But what is the worst that can happen with an Apple TV?

 

[MagicDude4Eva]

But what is the worst that can happen with an Apple TV?

I heard that hackers specifically target the deletion of Clifton Shores and Project Runway - soooo worried right now

 

[creeper]

I heard that hackers specifically target the deletion of Clifton Shores and Project Runway - soooo worried right now

Never realized you stayed in the East if they can just figure out how to block Justin Bieber, I might allow them full access

 

[noxibox]

Never realized you stayed in the East if they can just figure out how to block Justin Bieber, I might allow them full access

Justin Bieber is the malicious code they inject into your system.

 

[GreGorGy]

Fixed

http://www.macupdate.com/app/mac/52249/os-x-bash-update

http://support.apple.com/kb/DL1768

http://support.apple.com/kb/DL1767