Sidebar Sidebar
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

Apple Releases OS X Bash Update to Fix 'Shellshock' Security Flaw in Mavericks, Mountain Lion, and Lion

BillyTrimble said:
With comments like this (and about 75% of the other juvenile comments) it's really hard to come to these forum and expect to get useful information without wading through enormous piles of cr*p presumably posted by pimply adolescents who can't get dates and spend their time thinking of ways to post useless, but completely unfunny, comments.
Click to expand...

or you can just admit that you shouldn't have asked why in attempt to be right about something.
 
I don't see this in regular software update, isn't this important enough to show there? ;)

----------

Ok, I think this is when the rubber meets the road. This is a major security hole. Apple is big in security. It always made fun of PC because of the viruses afflicting PC machines. We are all holding our breath to hear great news about how Apple is going to tackle such a huge security hole, and then:

This is what we get:
1. Some PR announcement saying that most people are not affected, without going into details on who might be affected and how. Pathetic :(
2. Releasing a fix that apparently is not even available through regular update.

I have a Ubuntu machine and I think i have received no less than 3 updates to bash since the problem was announced.

I know that a big company has to be cautious about the fixes it releases, but this is bordering a ridiculous failure. I would expect a multibillion corporation to fix this quick and with full transparency.

My 2 cents.
 
This is weird. I have installed the update via the direct download from Apple but when I go ahead to test out in terminal it still behaves as its vulnerable. But the version is newer which is version 3.2.53(1)-release when before it said 3.2.51(1) before the patch. Any help?
 
Tim Cook stop being lazy and tell your developers this update does not show up into app store. DAMN! WTF is happening with Apple seriously iOS 8 failing and now this are drunk?
 
hehe... the name says it all...

Seriously...

Anyone wanna use Windows ? It's looking better choice every day.

While Apple may have it in Software Update shortly.. I always have my issues until i see it with my own eyes..

Any long standing Apple user will know when Apple means "fixes" what they *really* mean is "still busted*
 
Many thanks to the guy who provided the link to this update. However, what I did see in the compendium of suggested updates in App Store, was OS update 10.9.5 (no reports from MacRumors, strange). Was the BASH sec fix bundled in this update?
 
ovJmhUx.png


Hmm.
 
when i search for updates, no updates are found. Checked on my late 2013 iMac and macbook pro

someone else is in this situation?
 
I'm on 10.9.5 and I can't see the update. I'll do it manually, but Apple's constant cockups of software updates lately is concerning.
 
ebika said:
I came across this to check for vulnerabilities: https://github.com/hannob/bashcheck . It reports that the updates from Apple, 3.2.54, and 4.3.27 are still vulnerable to CVE-2014-7186 (redir_stack bug).
Click to expand...

This test indicates that bash is "vulnerable" because bash gives a segmentation fault there. Because Apple's patch won't pass functions by default, the concern isn't that bash is truly vulnerable, but rather that the crash could potentially open up some other access, same as the crash of any other binary.
More in-depth testing on CVE-2014-7186 is here: https://lists.gnu.org/archive/html/bug-bash/2014-09/msg00238.html
Aside from that fault, Apple's bash after this patch is not vulnerable.
 
JustinePaula said:
Did I miss something, 10.9.5 or later, what for the love of apples is later than 10.9.5??
Click to expand...

It’s just a generic statement. It simply means that you need at least 10.9.5. If you happen to run 10.9.6 (if that’s ever released) then you can install this fix too.
 
As of last evening (I haven't been on my Mac 10.9.5 this morning), the Bash update hadn't shown up in my Software Update either.

Perhaps it has something to do with Apple saying that most OS X users are not at risk; but being that the Bash shell is just one icon click away (opening Terminal).

I thought about doing the manual upgrade from Apple's support technote, but figured I'd just update through Software Update and let Apple tell me when I need it.

Huracan said:
I don't see this in regular software update, isn't this important enough to show there? ;)
Click to expand...
 
chrfr said:
This test indicates that bash is "vulnerable" because bash gives a segmentation fault there. Because Apple's patch won't pass functions by default, the concern isn't that bash is truly vulnerable, but rather that the crash could potentially open up some other access, same as the crash of any other binary.

More in-depth testing on CVE-2014-7186 is here: https://lists.gnu.org/archive/html/bug-bash/2014-09/msg00238.html

Aside from that fault, Apple's bash after this patch is not vulnerable.
Click to expand...


Isn't that the point of CVE-2014-7186 though, that the segfault is an opening, even if it's a pain to exploit? I feel better that the low hanging fruit issues were patched, but still uneasy that bash can be crashed so easily. I'll keep following that mail thread to see if I should be more concerned.
 
I don't really care for myself, but not being in Software Update/App Store Updates means inexpert users won't know about or get it, nor will it flow down to enterprise management systems which replicate from Apple's main system (aka local Software Update server, e.g.: as found in OS X Server).
 
ebika said:
Isn't that the point of CVE-2014-7186 though, that the segfault is an opening, even if it's a pain to exploit? I feel better that the low hanging fruit issues were patched, but still uneasy that bash can be crashed so easily. I'll keep following that mail thread to see if I should be more concerned.
Click to expand...

It's potentially an opening, yes, so I do hope that bash receives further maintenance from Apple. At least the direct issue is mitigated for now.

----------
batchtaster said:
I don't really care for myself, but not being in Software Update/App Store Updates means inexpert users won't know about or get it, nor will it flow down to enterprise management systems which replicate from Apple's main system (aka local Software Update server, e.g.: as found in OS X Server).
Click to expand...

It took me 2 minutes total to add it to my deployment system. Presumably professional system administrators will be on top of this.
As for why it's not in Software Update? A huge mystery to say the least.
 
You must log in or register to reply here.
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.
Top Bottom
Back