Slashdot Mirror
Apple Fixes Shellshock In OS X
jones_supa (887896) writes Apple has released the OS X Bash Update 1.0 for OS X Mavericks, Mountain Lion, and Lion, a patch that fixes the "Shellshock" bug in the Bash shell. Bash, which is the default shell for many Linux-based operating systems, has been updated two times to fix the bug, and many Linux distributions have already issued updates to their users. When installed on an OS X Mavericks system, the patch upgrades the Bash shell from version 3.2.51 to version 3.2.53. The update requires the OS X 10.9.5, 10.8.5, or 10.7.5 updates to be installed on the system first. An Apple representative told Ars Technica that OS X Yosemite, the upcoming version of OS X, will receive the patch later.
I have 10.9.5 and checked for software updates. None. Why do I have to click the link in the slashdot article and manually download the patch?!?!?
How about releasing a version of bash that has function passing disabled. That would be safer and we can find out what breaks.
NB: The message above might reflect my opinion right now, but not necessarily tomorrow or next year.
only took them five days to fix from the disclosure.
Political debates have me rolling my eyes so much I think I got optical whiplash. I should sue. - Foamy The Squirrel
This is the kind of thing people on the slashdot of yesteryear thought were impossible. Remember when people would post that Apple computers and/or Linux wasn't vulnerable like Windows?
Good times. I mean, I'm not trying to claim Windows has improved in security that it's no longer the easiest target or anything. Just that things have changed since that bygone era.
But even here, again, when you look at a typical OS X desktop system, now many people:
1. Have apache enabled AND exposed to the public internet (i.e., not behind a NAT router, firewall, etc)?
2. Even have apache or any other services enabled at all?
So, in the context of OS X, it's yet another theoretical exploit; "theoretical" in the sense that it effects essentially zero conventional OS X desktop users. Could there have been a worm or other attack vector which then exploited the bash vulnerability on OS X? Sure, I suppose. But there wasn't, and it's a moot point since a patch is now available within days of the disclosure.
And people running OS X as web servers exposed to the public internet, with the demise of the standalone Mac OS X Server products as of 10.6, is almost a thing of yesteryear itself.
Nothing has changed since that era: all OSes have always been vulnerable to attacks, both via local and remote by various means, and there have been any number of vulnerabilities that have only impacted UN*X systems, Linux and OS X included, and not Windows, over very many years. So yeah, nothing has changed, and OS X (and iOS) is still a very secure OS, by any definition or viewpoint of the definition of "secure", when viewed alongside Windows (and Android).
. . . until they do.
With more Apple computers running in high-value commercial enterprises, one has to wonder why they are so lax about security.
At least it's still news when we learn about Mac and Linux vulnerabilities. :-)
This is Bash, remember.
Stallman and the Free Software Foundation (FSF) considered a free shell that could run existing sh scripts so strategic to a completely free system built from BSD and GNU code that this was one of the few projects they funded themselves.
Bash (Unix shell)
The beta was released in 1989. 25 years ago.
Which makes a perfect farce of the notion that many eyes make all bugs shallow.
Where's this #%)&@@^ U2 album come from?!
I never asked for this...
the preceding comment is my own and in no way reflects the opinion of the Joint Chiefs of Staff
You forgot: mod_cgi needs to be manually turned on in the web server also. If you're running php instead, you are not vulnerable (which makes a change).
I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
Everyone should just go and learn C and how to do POSIX programming, attain enough mastery in it to be able to diagnose code for obscure security issues (that have eluded many programmers for years) and then design a secure fix.
And they should do that in a day.
Ya that sounds reasonable.
FYI not only are most people not programmers, and have no interest in becoming programmers, but most lack the kind of brain it takes to be a good programmer. The whole "Oh it is OSS fix it yourself!" argument is a really stupid one.
Apple wouldn't have known about this little known old feature turned security hole if it wasn't for open source. Windows having similar holes, wouldn't benefit from other operating systems discovering common flaws in their code base!
Diversity of the many systems that use BASH also provides increased security. People on linux are going to think twice about risky things involving bash for a while now, while Apple had no such security issues because they jail and limit their DHCP client like freeBSD also does.
The idea that you'd run bash commands as root from a DHCP server is crazy unless you were running servers on a private network (along with NFS) and perhaps this is why linux people didn't have any troubles with their implementation given their needs at the time. What we could use is more linux desktop developers because they'd have freaked out at the proper time and prevented this decades ago.
Democracy Now! - uncensored, anti-establishment news
I checked this out: http://www.macissues.com/2014/09/25/how-to-unofficially-fix-the-shell-shock-bash-vulnerability-in-os-x/
Then patched and built bash in my macbook pro 10.6.8.
Easy.
GNU :-)
You're right. OSX is held together by plist files and shiny white rounded-corner duct tape.
It's clearly classier.
I have just received news of 3 updates, including the 1st release of the GM image.
Never saw a reason to abandon it. Still don't.
1) We don't know when the bug was introduced, although it's clear that it was quite some time ago.
2) I defy you to name any version of any reasonably complex software that is guaranteed to be free of exploitable bugs. It's been shown by people much smarter than me that it's mathmatically impossible to do so. (Just one example thread discussing the problem.)
The difference is that with OSS, they all will eventually get found and fixed. The same can't be said of closed source software.
Did anyone try to understand how this "bug" works?
Unless you have any service running, connected to the internet, that starts "bash scripts", nothing can happen to your computer.
Or how exactly do you think angel'o'sphere has any way (not chance! WAY!) at all to start a bash script on your computer, exploit the weakness and on top of that gain "super user" privileges?
That is not going to happen for any private mac user who has not running an Apache etc. and has not activated CGI scripts (and a router configured to route port 80 traffic to your Mac).
Sorry, this "Apple is late" mantras are simply bullshit.
Cost free eBook I read (by iBook/Kobo/Amazon/ObookO/Gutenberg etc.): "The Green Odyssey" by Philip Jose Farmer.
Billions of lines of code for decades and some security holes make you think that you have PROOF open source does not work? Foolish.
The discovery of this is proof that many eyes DO find problems--- Apple could have done it themselves and it could have gone forever not being discovered. Apple has hardly ANY code that old and don't think that newer code is somehow automatically better than old code.
How can you possibly think that something that wasn't noticed by all those people for decades is somehow the fault of all those people NOT seeing it for two decades?
Furthermore, this was a feature it wasn't entirely a security bug so it wasn't going completely unnoticed - people knew about the thing and some scripts are going to break that depended upon it when it has been completely fixed. With more people aware of this new attack vector, bash is going to get more attention--- MORE eyes again.
Democracy Now! - uncensored, anti-establishment news