Slashdot Mirror
Apple Fixes Shellshock In OS X
jones_supa (887896) writes Apple has released the OS X Bash Update 1.0 for OS X Mavericks, Mountain Lion, and Lion, a patch that fixes the "Shellshock" bug in the Bash shell. Bash, which is the default shell for many Linux-based operating systems, has been updated two times to fix the bug, and many Linux distributions have already issued updates to their users. When installed on an OS X Mavericks system, the patch upgrades the Bash shell from version 3.2.51 to version 3.2.53. The update requires the OS X 10.9.5, 10.8.5, or 10.7.5 updates to be installed on the system first. An Apple representative told Ars Technica that OS X Yosemite, the upcoming version of OS X, will receive the patch later.
I have 10.9.5 and checked for software updates. None. Why do I have to click the link in the slashdot article and manually download the patch?!?!?
How about releasing a version of bash that has function passing disabled. That would be safer and we can find out what breaks.
NB: The message above might reflect my opinion right now, but not necessarily tomorrow or next year.
only took them five days to fix from the disclosure.
Political debates have me rolling my eyes so much I think I got optical whiplash. I should sue. - Foamy The Squirrel
This is the kind of thing people on the slashdot of yesteryear thought were impossible. Remember when people would post that Apple computers and/or Linux wasn't vulnerable like Windows?
Good times. I mean, I'm not trying to claim Windows has improved in security that it's no longer the easiest target or anything. Just that things have changed since that bygone era.
You, user 'i kan reed', are the worst thing about this 'modern era' of Slashdot. How you can remember that era and post such thoughtless, trivial and inane tripe is beyond me. Was it the "sexy beta" that attracted your type?
At least it's still news when we learn about Mac and Linux vulnerabilities. :-)
Goood, let the butthurt flow through you.
Linux is pretty solid at this point, however the free ecosystem is absolutely full of additional software that is used by default in allmost all installations that is much more suspect. The caliber of the people who build and maintain this software just is not on par with the people who are employed at professional software design houses, the testing is not as rigorous, and the source code is available for people to inspect for attack vectors. Yet people think nothing of installing this on mission-critical systems and loading it up with sensitive data. It's a ticking time bomb, and this is likely just the blasting cap going off.
It's a ticking time bomb, and this is likely just the blasting cap going off.
So you're expecting an 'explosion' even worse than Shellshock and co?
I doubt it. Bash will be hammered on, and will be made more secure, in the coming weeks.
I actually like this piece which makes the argument that it's not a bug, but a feature:
I would argue that the bash security concern is not a bug. It is clearly a feature. Admittedly, a misguided and misimplemented feature, but still a feature. The problem is that it was designed 25 years ago. ...The problem we have is not a bash bug, but is basically similar to the Ariane 5 bug: using a component from an earlier systems out of specifications.
I live in constant fear of the Coming of the Red Spiders.
Only the idiots claimed it was impossible. It was much more unlikely because Windows was designed at the time from the ground up to be backdoored. It was literally defective by design. It has come a long way and malware makers have also gotten much more sophisticated. A lot of them are users of linux and unix systems and naturally enough they now design for those systems as well. One reason is that the newer linux distros are not as security focused as the old days. People routinely log into a user account that has all kinds of priviledges that once were reserved to the root user. The continual drive for the latest and greatest features has led to using the testing branch of debian as well. At this moment I'm on a machine runniing SparkyLinux 3.5 which is derived from the debian testing repos and I'd never use it for banking or anything like that.
NT security model is vastly superior to mathematically unsound, outdated Unix security model, which most of Linux installations still use.
I wouldn't go that far. Windows installations routinely get reamed. It's better but I wouldn't call it secure. I've got a secure linux install on a seperate laptop for banking and such and it's locked down like Fort Knox. As I only use it for things I'm paranoid about I'd say it's pretty safe. I'd rather bet on it than Windows.
Yes but the problem is and has always been Microsoft does not really use the NT security model but instead "re-implements" lots of controls in upper layers. Those layers in the past tended to be running with pretty high NT model privileges (that has gotten much better).
Repeal the 17th Amendment TODAY! Also Please Read http://www.gnu.org/philosophy/right-to-read.html
NT security model is vastly superior to mathematically unsound, outdated Unix security model, which most of Linux installations still use.
Which is why it takes two weeks and three requests to be able to install software on my Windows box at any job I've worked. Honestly, it doesn't matter how superior something is if it's run by idiots or if it's so "advanced" that no one will knows how it works.
Passing functions on environment variables is a feature, executing code after the function definition is parsing error.
As the article states is was never documented, and after trying really hard can't think of legitimate reasons to do it when there is a defined documented method for executing statements in the subshell via arguments "-c"
Which is not say, it was never done via someone doing some "clever" programing but if it was it probably was not a "good idea"
So no I think its bug, and a bit dishonest to try an spin it otherwise.
Repeal the 17th Amendment TODAY! Also Please Read http://www.gnu.org/philosophy/right-to-read.html
I'm just saying a few years ago, we had an awful lot of that variety of idiot.
This is the kind of thing people on the slashdot of yesteryear thought were impossible. Remember when people would post that Apple computers and/or Linux wasn't vulnerable like Windows?
No what people have said is that Windows was vulnerable in different ways than Linux or Unix. Viruses were/are a huge problem for Windows machines and largely a Windows problem. All machines can be compromised with a Trojan if the user allows it to run. Vulnerabilities affect all systems but Linux, Unix, and OS X are built differently than Windows.
Well, there's spam egg sausage and spam, that's not got much spam in it.
But even here, again, when you look at a typical OS X desktop system, now many people:
1. Have apache enabled AND exposed to the public internet (i.e., not behind a NAT router, firewall, etc)?
2. Even have apache or any other services enabled at all?
So, in the context of OS X, it's yet another theoretical exploit; "theoretical" in the sense that it effects essentially zero conventional OS X desktop users. Could there have been a worm or other attack vector which then exploited the bash vulnerability on OS X? Sure, I suppose. But there wasn't, and it's a moot point since a patch is now available within days of the disclosure.
And people running OS X as web servers exposed to the public internet, with the demise of the standalone Mac OS X Server products as of 10.6, is almost a thing of yesteryear itself.
Nothing has changed since that era: all OSes have always been vulnerable to attacks, both via local and remote by various means, and there have been any number of vulnerabilities that have only impacted UN*X systems, Linux and OS X included, and not Windows, over very many years. So yeah, nothing has changed, and OS X (and iOS) is still a very secure OS, by any definition or viewpoint of the definition of "secure", when viewed alongside Windows (and Android).
When Mac and Linux and *nix can get infected by drive-bys then your post might have a point. And Windows has increased in security. But still remains the easiest and most supple target because of its security-by-obscurity (i.e. closed source) nature, and clown car mentality towards security built into it from the beginning.
Exactly. This is a problem Microsoft has had for several decades they lack mechanisms to generate internal consensus. So they build a capabilities based security model but then don't build all the tools and support that their user community will need to make it work so everyone just runs as admin. Then they tone it down and put a permissions based system in place. But that still has problems. Then they start tightening and then use sandboxing for yet another capabilities system...
. . . until they do.
With more Apple computers running in high-value commercial enterprises, one has to wonder why they are so lax about security.
Sure, but how many server administrators are going to actually update? Linux has a reputation of updates breaking builds and I suspect a lot of budget server administrators don't touch the updates on their Linux boxes once they go live for fear of borking them.
At least it's still news when we learn about Mac and Linux vulnerabilities. :-)
This is Bash, remember.
Stallman and the Free Software Foundation (FSF) considered a free shell that could run existing sh scripts so strategic to a completely free system built from BSD and GNU code that this was one of the few projects they funded themselves.
Bash (Unix shell)
The beta was released in 1989. 25 years ago.
Which makes a perfect farce of the notion that many eyes make all bugs shallow.
Where's this #%)&@@^ U2 album come from?!
I never asked for this...
the preceding comment is my own and in no way reflects the opinion of the Joint Chiefs of Staff
I like how slashdot are making out that this is more of an apple problem when perhaps 0.0001% of apple users are even running a web server and most of those are using php and not mod_cgi, the dhcp client is not vulnerable, etc.
Yet Linux with dhcp client vulnerable and a whole slew of other system utilities potential vulnerable due to using bash everywhere to glue tools together is given a pass.
bash still isn't fixed properly yet, and until it is, any linux box with a dynamic IP address sis potentially at risk.
I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
You forgot: mod_cgi needs to be manually turned on in the web server also. If you're running php instead, you are not vulnerable (which makes a change).
I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
Everyone should just go and learn C and how to do POSIX programming, attain enough mastery in it to be able to diagnose code for obscure security issues (that have eluded many programmers for years) and then design a secure fix.
And they should do that in a day.
Ya that sounds reasonable.
FYI not only are most people not programmers, and have no interest in becoming programmers, but most lack the kind of brain it takes to be a good programmer. The whole "Oh it is OSS fix it yourself!" argument is a really stupid one.
Apple wouldn't have known about this little known old feature turned security hole if it wasn't for open source. Windows having similar holes, wouldn't benefit from other operating systems discovering common flaws in their code base!
Diversity of the many systems that use BASH also provides increased security. People on linux are going to think twice about risky things involving bash for a while now, while Apple had no such security issues because they jail and limit their DHCP client like freeBSD also does.
The idea that you'd run bash commands as root from a DHCP server is crazy unless you were running servers on a private network (along with NFS) and perhaps this is why linux people didn't have any troubles with their implementation given their needs at the time. What we could use is more linux desktop developers because they'd have freaked out at the proper time and prevented this decades ago.
Democracy Now! - uncensored, anti-establishment news
I checked this out: http://www.macissues.com/2014/09/25/how-to-unofficially-fix-the-shell-shock-bash-vulnerability-in-os-x/
Then patched and built bash in my macbook pro 10.6.8.
Easy.
GNU :-)
I have just received news of 3 updates, including the 1st release of the GM image.
Never saw a reason to abandon it. Still don't.
1) We don't know when the bug was introduced, although it's clear that it was quite some time ago.
2) I defy you to name any version of any reasonably complex software that is guaranteed to be free of exploitable bugs. It's been shown by people much smarter than me that it's mathmatically impossible to do so. (Just one example thread discussing the problem.)
The difference is that with OSS, they all will eventually get found and fixed. The same can't be said of closed source software.
Did anyone try to understand how this "bug" works?
Unless you have any service running, connected to the internet, that starts "bash scripts", nothing can happen to your computer.
Or how exactly do you think angel'o'sphere has any way (not chance! WAY!) at all to start a bash script on your computer, exploit the weakness and on top of that gain "super user" privileges?
That is not going to happen for any private mac user who has not running an Apache etc. and has not activated CGI scripts (and a router configured to route port 80 traffic to your Mac).
Sorry, this "Apple is late" mantras are simply bullshit.
Cost free eBook I read (by iBook/Kobo/Amazon/ObookO/Gutenberg etc.): "The Green Odyssey" by Philip Jose Farmer.
Billions of lines of code for decades and some security holes make you think that you have PROOF open source does not work? Foolish.
The discovery of this is proof that many eyes DO find problems--- Apple could have done it themselves and it could have gone forever not being discovered. Apple has hardly ANY code that old and don't think that newer code is somehow automatically better than old code.
How can you possibly think that something that wasn't noticed by all those people for decades is somehow the fault of all those people NOT seeing it for two decades?
Furthermore, this was a feature it wasn't entirely a security bug so it wasn't going completely unnoticed - people knew about the thing and some scripts are going to break that depended upon it when it has been completely fixed. With more people aware of this new attack vector, bash is going to get more attention--- MORE eyes again.
Democracy Now! - uncensored, anti-establishment news
But: