Apple has just released a new important software security update to patch the new Shellshock vulnerability for its Mac systems. The update is now available through Apple and is titled the OS X bash Update 1.0 download. There are separate downloads, depending on which version of the OS X operating system your Mac is currently running, whether it's Lion, Mountain Lion, or Mavericks.
Apple had previously said that most of its Mac users are safe from the exploit.
- Download: Mavericks, Lion, Mountain Lion
Reader comments
Apple releases OS X bash security update to help prevent Shellshock on Macs
Hmmm so are Yosemite beta testers still vulnerable or...?
Sent from the iMore App
I've heard it said (I don't now remember where) that Yosemite isn't affected by this BASH vulnerability.
I'd be curious to know exactly what 'advanced UNIX services' they're talking about that might be involved...
To be clear, no one is vulnerable unless they're hosting services that access bash on a machine that's accessible to the outside world. Which wouldn't be a good idea to do on a beta operating system, just on principle.
Ah okay never accessed (and just skimmed the story) so guess I should have payed more attention. Thanks :-)
Sent from the iMore App
weird. i'm on the public beta and it still says i'm vulnerable (ran a patch before Apple's official one which isn't even for Yosemite which has already been established). Only thing i can think of that would be using bash is Screens Connect...is that an issue? :/
maybe a new seed of the beta is around the corner anyway and they'll just slip it in
If you aren't running any UNIX services that allow access to your machine remotely then you have absolutely nothing to worry about. (safe to assume 98% of the users have no idea what these services are)
Not a full patch? It does fix part of the vulnerability, but according to the test at https://github.com/hannob/bashcheck/blob/master/bashcheck, after the patch, bash on OS X is still vulnerable to CVE-2014-7186 (redir_stack bug).
Results are:
$ ./bashcheck
Not vulnerable to CVE-2014-6271 (original shellshock)
Not vulnerable to CVE-2014-7169 (taviso bug)
./bashcheck: line 18: 601 Segmentation fault: 11 bash -c "true $(printf '<<EOF %.0s' {1..79})" 2> /dev/null
Vulnerable to CVE-2014-7186 (redir_stack bug)
Test for CVE-2014-7187 not reliable without address sanitizer
Variable function parser inactive, likely safe from unknown parser bugs
So they people trying to make apples software better for everyone are left with potential security flaws? The beta tester should have got it first or at the same time. I just hope beta testers get it soon.
Sent from the iMore App
This should pop up in the updates section of the App Store app, right?
Alas, it doesn't.
Yeah doesn't show up on mine either
I thought they were not vulnerable anyway, according to a previous article.
Macs don't use dhclient (which is script-based), but it's not impossible that some part of the OSX dhcp client stack does spawn a shell with some variables passed around. I suspect that if it did, Apple would be pushing out an update more urgently, but since I don't know for sure, I'm going to stand corrected instead.
Don't connect to unauthenticated access points for a while, folks or until your patched