Hacker News Reader

Comment by Glan1984 | Hacker News Reader

How about installing zsh and making that the default shell? Is that enough?

zsh is also vulnerable. (it's a bash derivative)

Can you show example code exploiting zsh? I haven't seen such, nor found such:

  » V='() { :; }; echo busted' zsh -c "echo hi"
  hi

But:

  » V='() { :; }; echo busted' bash -c "echo hi"
  busted
  hi

That's incorrect; it does not appear to have the "export function" feature that this bug relies on.