Bashing bash one more time: updated universal 4.3.30 covering all known bash flaws

FINAL UPDATE: 4.3.30 is now available. There are no new tests, and it is not clear the flaws it fixes are exploitable with the other changes, but it is available for those that wish it. Assuming no other vulnerabilities are found in the near future, this should be the last patch.

UPDATE THE THIRD: To clarify some questions, 4.3.28 is not vulnerable to CVE-2014-6277 and -6278, as well as all the other reported vulnerabilities. See Michal Zalewski's post on the subject.

UPDATE THE SECOND: It's a bug bash! Updated to 4.3.28 below with more fixes for two more internal vulnerabilities (CVE-2014-7186 and -7187). Hopefully this should be the last one for awhile. Just overlay it over your old copy of 4.3.2x.

UPDATE: bash just keeps on giving. Updated to 4.3.27 below with more steps to repair this vulnerability. Just overlay it over your old copy of 4.3.26.

See the previous entry, but in short, bash has been shown to have a pretty nasty little vulnerability that causes it to inadvertently execute shell commands in the environment you pass it. This attack does work on Power Macs because most shell commands are cross-platform, and appears to exist on all versions of OS X.

The solution is easy: build a new bash from the newly patched source code. As a service to you, I have done so, and compiled it for PowerPC and Intel so it will also work for users on 10.6 who are not receiving updates either. See above The version earlier today had a preliminary version of the patch which does not fix a second variant vulnerability. This version does. If you used one of the "build from source" tricks that were circulating earlier today (MacRumors, etc.), your version does NOT have this second issue patched. Either wait for the public source trees to update and rebuild it (likely early tomorrow), or use this one.

The bash these steps will install works on 10.4 all the way to 10.9 on 32-bit Intel, 64-bit Intel and PowerPC. It requires no other dependencies. The idea is to replace your system bash -- yes, you can use Homebrew, Tigerbrew, MacPorts, etc., to get an updated copy, but your built-in bash is still vulnerable unless you replace it. This is designed to accomplish that. WARNING AGAIN: If you are not comfortable with the Terminal, get someone to help you!

1. In a Terminal.app window, verify that you have a vulnerable system so that you can see what that looks like (the command is all one line):

   env x='() { :;}; echo vulnerable' bash -c "echo this is a test"

   It should print

   vulnerable
   this is a test

2. Check the second vulnerability. This creates a file called echo with the date in it, if your system is vulnerable:

   env X='() { (a)=>\' sh -c "echo date"; cat echo

   It should print something like (the messages and of course the time will vary):

   bash: X: line 1: syntax error near unexpected token `='
   bash: X: line 1: `'
   bash: error importing function definition for `X'
   Thu Sep 25 22:12:49 PDT 2014

   (Delete the file it makes before you continue! rm echo)

3. Check the third vulnerability.

   env foo='() { echo not patched; }' bash -c foo

   It should print

   not patched

4. NEW: Check the fourth vulnerability.

   bash -c 'true <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF' || echo "vulnerable"

   It should print (the exact number of lines may vary):

   bash: line 1: warning: here-document at line 1 delimited by end-of-file (wanted `EOF')
   bash: line 1: warning: here-document at line 1 delimited by end-of-file (wanted `EOF')
   bash: line 1: warning: here-document at line 1 delimited by end-of-file (wanted `EOF')
   bash: line 1: warning: here-document at line 1 delimited by end-of-file (wanted `EOF')
   bash: line 1: warning: here-document at line 1 delimited by end-of-file (wanted `EOF')
   bash: line 1: warning: here-document at line 1 delimited by end-of-file (wanted `EOF')
   bash: line 1: warning: here-document at line 1 delimited by end-of-file (wanted `EOF')
   bash: line 1: warning: here-document at line 1 delimited by end-of-file (wanted `EOF')
   bash: line 1: warning: here-document at line 1 delimited by end-of-file (wanted `EOF')
   bash: line 1: warning: here-document at line 1 delimited by end-of-file (wanted `EOF')
   Bus error
   vulnerable

5. NEW: Check the fifth vulnerability.

   bash -c '( for x in {1..200} ; do echo "for x$x in ; do :" ; done ; for x in {1..200} ; do echo done ; done )' | bash || echo "vulnerable"

   It should print (the exact number may vary):

   bash: line 129: syntax error near `x129'
   bash: line 129: `for x129 in ; do :'
   vulnerable

6. This has now been patched to 4.3.30. This has now been patched to 4.3.28. This has now been patched to 4.3.27. Download the patched bash 4.3.26. Put it in your home directory. If necessary, double-click to decompress it so that you have a file in your home directory called bash-4.3.30-10.4u.

7. Close all terminal windows and programs just to make sure you won't stomp on bash while a program is trying to call it. Start Terminal and have exactly one window open.

8. In that terminal window:
   • exec tcsh
   • chmod +x bash-4.3.30-10.4u

     If you replaced /bin/bash (and/or /bin/sh) with any earlier version of these patched bashes, DO NOT DO THE NEXT TWO COMMANDS. If you have never replaced them, go ahead; these will put the old ones in a safe place, just in case.

   • sudo mv /bin/bash /bin/bash_old (enter your password)
   • sudo mv /bin/sh /bin/sh_old (enter your password if needed)

     Everybody does these:

   • sudo cp bash-4.3.30-10.4u /bin/bash (enter your password if needed)
   • sudo cp bash-4.3.30-10.4u /bin/sh (enter your password if needed)

9. Test it stuck by trying the statements again:

   env x='() { :;}; echo vulnerable' bash -c "echo this is a test"

   It should print

   this is a test

   Now, try the second one:

   env X='() { (a)=>\' sh -c "echo date"; cat echo

   It should print

   date
   cat: echo: No such file or directory

   If this test appears to fail, make sure that you delete the file echo (rm echo) first, and test it again.

   Now, try the third one:

   env foo='() { echo not patched; }' bash -c foo

   It should print

   bash: foo: command not found

   Now, try the fourth one:

   bash -c 'true <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF' || echo "vulnerable"

   It should print (there should be exactly 14 lines, one for each <<EOF):

   bash: line 1: warning: here-document at line 0 delimited by end-of-file (wanted `EOF')
   bash: line 1: warning: here-document at line 0 delimited by end-of-file (wanted `EOF')
   bash: line 1: warning: here-document at line 0 delimited by end-of-file (wanted `EOF')
   bash: line 1: warning: here-document at line 0 delimited by end-of-file (wanted `EOF')
   bash: line 1: warning: here-document at line 0 delimited by end-of-file (wanted `EOF')
   bash: line 1: warning: here-document at line 0 delimited by end-of-file (wanted `EOF')
   bash: line 1: warning: here-document at line 0 delimited by end-of-file (wanted `EOF')
   bash: line 1: warning: here-document at line 0 delimited by end-of-file (wanted `EOF')
   bash: line 1: warning: here-document at line 0 delimited by end-of-file (wanted `EOF')
   bash: line 1: warning: here-document at line 0 delimited by end-of-file (wanted `EOF')
   bash: line 1: warning: here-document at line 0 delimited by end-of-file (wanted `EOF')
   bash: line 1: warning: here-document at line 0 delimited by end-of-file (wanted `EOF')
   bash: line 1: warning: here-document at line 0 delimited by end-of-file (wanted `EOF')
   bash: line 1: warning: here-document at line 0 delimited by end-of-file (wanted `EOF')
   

   Now, try the fifth one:

   bash -c '( for x in {1..200} ; do echo "for x$x in ; do :" ; done ; for x in {1..200} ; do echo done ; done )' | bash || echo "vulnerable"

   Nothing will appear. However, if you want a positive test, do the following:

   bash -c '( for x in {1..200} ; do echo "for x$x in ; do :" ; done ; for x in {1..200} ; do echo done ; done )' | bash && echo "not vulnerable"

   It should print:

   not vulnerable

10. Restart your Mac as a paranoia to make sure everything is using the new copy of bash.

11. Bask in the glow. Then, find a shell that doesn't suck.