Hacker News Reader

Comment by _b8r0 | Hacker News Reader

My OSX Mavericks install appears to be affected:

  foom:~ steve$ env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
  vulnerable
  this is a test

View on HN

Doesn't OSX ship the 8-year-old bash 3.2 (2006) i.e. the last version available as GPLv2? (Apple hates GPLv3)

For me in 10.9.5:

  $ bash --version
  GNU bash, version 3.2.51(1)-release (x86_64-apple-darwin13)
  Copyright (C) 2007 Free Software Foundation, Inc.

It does. I installed an up-to-date version with homebrew a few months ago, and it was vulnerable as well. After a `brew update && brew upgrade bash` I had the fix installed, though :)

If i remember correctly Apples stopped updating bash in OSX a long time ago I wonder if this will get fixed.

My OSX was vulnerable too, but I use Homebrew, and the latest version of bash available via brew update && brew upgrade is patched against this.

If you haven't already been using Homebrew though, you will likely need to move /usr/local/bin infront of /usr/bin in your path, otherwise the old bash would still be used.

Reply on news.ycombinator.com