env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
vulnerablethis is a test
The vast majority of OS X users are not at risk to recently reported bash vulnerabilities. Bash, a UNIX command shell and language included in OS X, has a weakness that could allow unauthorized users to remotely gain control of vulnerable systems. With OS X, systems are safe by default and not exposed to remote exploits of bash unless users configure advanced UNIX services. We are working to quickly provide a software update for our advanced UNIX users.
The core of this attack is to create an environment variable that looks like a Bash scripting function but ends with the invocation of a program, and then causing Bash to be run. Bash will see the environment variable, parse it, and then keep parsing past the end of the function and run the program.Any method of triggering Bash execution with at least one attacker-controlled environment variable will work. Web server CGI attacks are getting the attention right now, but a user logging in over SSH could do it (a failed login, however, can't). It's possible that some FTP servers could trigger it (say, through running a post-upload script). A PackageMaker-based installer could trigger it, but if you're running a hostile installer, you've got bigger problems than this. There are probably many other ways as well.The average desktop user doing average desktop user activities is unlikely to have open attack vectors that could be used to trigger this bug, but Bash shows up in enough unexpected places that it's impossible to say for sure.
The vast majority of OS X users are not at risk to recently reported bash vulnerabilities.
Pieterr om 8:05, 27-09-2014@mattiman: Als je een webserver draait op je Mac bijvoorbeeld. Zie ook volgende link: http://arstechnica.com/security/2014/09/still-more-vulnerabilities-in-bash-shellshock-becomes-whack-a-mole/De problemen met Bash zijn nog niet volledig opgelost met de huidige patches. De meer rigoureuze oplossingen (zoals het automatisch importeren van functies in de bash shell uitzetten) zijn niet backward-compatible en kunnen voor veel extra (validatie)werk gaan zorgen voor leveranciers van (embedded) software systemen.
Gast
