Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

roadbloc

macrumors G3
Original poster
Aug 24, 2009
8,784
215
UK
Well, I know for certain that Tiger is vulnerable to the bash bug and I was wondering what it means for us PowerPC users who will most likely not get a fix from Apple.

We had to abandon Flash due to vulnerabilities, but is it now time to abandon PPC altogether? Or is this simply a case of a vulnerability being over-hyped and in reality we're actually probably going to be okay?

Discuss. :)
 

Attachments

  • bashbug.png
    bashbug.png
    17.2 KB · Views: 307

Intell

macrumors P6
Jan 24, 2010
18,955
509
Inside
Just recompile the bash and sh binaries from Apple's source and patch. It takes about 10 minutes.
 

vlark

macrumors member
Mar 13, 2014
97
0
Just recompile the bash and sh binaries from Apple's source and patch. It takes about 10 minutes.

Well, sure, for the truly technical minded with the right software installed to do this.

But I'm not that technically minded. Can someone on these boards roll up a patched versions for 10.3.9, 10.4.11 and 10.5.8 PPC and post them, along with installation instructions? I'm clueless on how to go about patching Unix things. I avoid the terminal unless I have explicit step-by-step instructions on what to do. Yes, it's nice that Macs have the power of Unix under the hood, but I don't pop my engine and tinker with it on a regular basis (even though I know I probably should).
 

Intell

macrumors P6
Jan 24, 2010
18,955
509
Inside
All you need is Xcode to be installed. That's it. Later today I'll be able to post the complete Terminal lines to build and install the patched versions.
 

vlark

macrumors member
Mar 13, 2014
97
0
I only have Xcode from the Tiger retail disk; I don't have Xcode for Leopard. Is it still available from ADC?
 

Intell

macrumors P6
Jan 24, 2010
18,955
509
Inside
While the steps posted above seem out of action at the moment, here's how you can build and replace your own. All you need is an internet connection and Xcode 3.1 or later to be installed. Just copy and paste the lines one at a time and you'll be all done. If at any point you get an error, stop and post the error. Failure to stop could lead to problems. Will work on 10.5.8 through 10.9.4.
 
Last edited:

archtopshop

macrumors regular
Dec 13, 2011
206
1
While the steps posted above seem out of action at the moment, here's how you can build and replace your own. All you need is an internet connection and Xcode to be installed. Just copy and paste the lines one at a time and you'll be all done. If at any point you get an error, stop and post the error. Failure to stop could lead to problems. Will work on 10.3.9 through 10.9.4.

Code:
cd /tmp/
mkdir bash-fix
cd bash-fix
curl -k https://opensource.apple.com/tarballs/bash/bash-92.tar.gz | tar zxf -
cd bash-92/bash-3.2
curl -k https://ftp.gnu.org/pub/gnu/bash/bash-3.2-patches/bash32-052 | patch -p0
cd ..
xcodebuild
sudo cp /bin/bash /bin/bash.old
sudo cp /bin/sh /bin/sh.old
build/Release/bash --version # GNU bash, version 3.2.52(1)-release
build/Release/sh --version   # GNU bash, version 3.2.52(1)-release
sudo cp build/Release/bash /bin
sudo cp build/Release/sh /bin
sudo chmod a-x /bin/bash.old /bin/sh.old

OK, I fixed the link to the tenfourfox blog.
 

Intell

macrumors P6
Jan 24, 2010
18,955
509
Inside
The link was fine, I was referring to the content within the link:
UPDATE: Looks like the fix is incomplete; someone found a way around it. I'll post an update with the newer version when they decide on it, but you can fix the immediate bug now with the steps below.
 

bunnspecial

macrumors G3
May 3, 2014
8,329
6,437
Kentucky
Intell's instructions above worked great on my MBP running 10.9.

I tried it on my iMac G4 running 10.5(after installing Xcode from the Leopard DVD). When I got to the compiling step, it gives me an error. Here's the full text of what I'm seeing

(NOTE: project bash was written by a newer Xcode version (45) -- temporarily downgrading it (without modifying project file))

=== BUILDING AGGREGATE TARGET ostype.h WITH THE DEFAULT CONFIGURATION (Release) ===

Checking Dependencies...
The file “BSD.xcconfig” does not exist. (/Developer/Makefiles/CoreOS/Xcode/BSD.xcconfig)

PhaseScriptExecution /tmp/bash-fix/bash-92/build/bash.build/Release/ostype.h.build/Script-59DC3C521120DC9C00B033EC.sh
mkdir /tmp/bash-fix/bash-92/build/bash.build/Release/ostype.h.build/DerivedSources
cd /tmp/bash-fix/bash-92
/bin/sh -c /tmp/bash-fix/bash-92/build/bash.build/Release/ostype.h.build/Script-59DC3C521120DC9C00B033EC.sh
REL=$(uname -r)
uname -r
OSVER=${REL%%.*}

cat > ${DERIVED_FILES_DIR}/ostype.h <<EOF
#ifndef __OSTYPE__
#define __OSTYPE__

#define OSTYPE "darwin${OSVER}"
#endif /* __OSTYPE__ */
EOF
# $(OBJROOT)/** didn't work in header search paths
ln -fs ${DERIVED_FILES_DIR}/ostype.h ${SYMROOT}


=== BUILDING NATIVE TARGET intl WITH THE DEFAULT CONFIGURATION (Release) ===

Checking Dependencies...
The file “BSD.xcconfig” does not exist. (/Developer/Makefiles/CoreOS/Xcode/BSD.xcconfig)

CompileC build/bash.build/Release/intl.build/Objects-normal/ppc/bindtextdom.o /tmp/bash-fix/bash-92/bash-3.2/lib/intl/bindtextdom.c normal ppc c com.apple.compilers.gcc.4_0
cd /tmp/bash-fix/bash-92
/Developer/usr/bin/gcc-4.0 -x c -arch ppc -pipe -std=gnu99 -Wno-trigraphs -fpascal-strings -fasm-blocks -Os -Werror-implicit-function-declaration -Wreturn-type -Wunused-variable -DM_UNIX -DIN_LIBINTL -DLIBDIR='"/usr/libdata"' -DLOCALEDIR='"/usr/share/locale"' -DLOCALE_ALIAS_PATH='"/usr/share/locale"' -DPACKAGE='"BASH"' -DSSH_SOURCE_BASHRC -DCONF_VENDOR='"apple"' -DCONF_MACHTYPE='"Mac"' -DMACOSX -DSHELL -DHAVE_CONFIG_H -fmessage-length=0 -mtune=G4 -gdwarf-2 -I/tmp/bash-fix/bash-92/build/bash.build/Release/intl.build/intl.hmap -F/tmp/bash-fix/bash-92/build/Release -I/tmp/bash-fix/bash-92/build -I. -Ibash-3.2 -Idoc -Ibash-3.2/builtins -Ibash-3.2/cross-build -Ibash-3.2/CWRU -Ibash-3.2/doc -Ibash-3.2/examples -Ibash-3.2/include -Ibash-3.2/lib -Ibash-3.2/po -Ibash-3.2/support -Ibash-3.2/tests -Ibash-3.2/CWRU/misc -Ibash-3.2/examples/bashdb -Ibash-3.2/examples/complete -Ibash-3.2/examples/functions -Ibash-3.2/examples/loadables -Ibash-3.2/examples/misc -Ibash-3.2/examples/obashdb -Ibash-3.2/examples/scripts -Ibash-3.2/examples/scripts.noah -Ibash-3.2/examples/scripts.v2 -Ibash-3.2/examples/startup-files -Ibash-3.2/lib/glob -Ibash-3.2/lib/intl -Ibash-3.2/lib/malloc -Ibash-3.2/lib/readline -Ibash-3.2/lib/sh -Ibash-3.2/lib/termcap -Ibash-3.2/lib/tilde -Ibash-3.2/tests/misc -Ibash-3.2/examples/loadables/perl -Ibash-3.2/examples/startup-files/apple -Ibash-3.2/lib/glob/doc -Ibash-3.2/lib/readline/doc -Ibash-3.2/lib/readline/examples -Ibash-3.2/lib/termcap/grot -I/tmp/bash-fix/bash-92/build/Release/include -I/tmp/bash-fix/bash-92/build/bash.build/Release/intl.build/DerivedSources -c /tmp/bash-fix/bash-92/bash-3.2/lib/intl/bindtextdom.c -o /tmp/bash-fix/bash-92/build/bash.build/Release/intl.build/Objects-normal/ppc/bindtextdom.o

CompileC build/bash.build/Release/intl.build/Objects-normal/ppc/dcgettext.o /tmp/bash-fix/bash-92/bash-3.2/lib/intl/dcgettext.c normal ppc c com.apple.compilers.gcc.4_0
cd /tmp/bash-fix/bash-92
/Developer/usr/bin/gcc-4.0 -x c -arch ppc -pipe -std=gnu99 -Wno-trigraphs -fpascal-strings -fasm-blocks -Os -Werror-implicit-function-declaration -Wreturn-type -Wunused-variable -DM_UNIX -DIN_LIBINTL -DLIBDIR='"/usr/libdata"' -DLOCALEDIR='"/usr/share/locale"' -DLOCALE_ALIAS_PATH='"/usr/share/locale"' -DPACKAGE='"BASH"' -DSSH_SOURCE_BASHRC -DCONF_VENDOR='"apple"' -DCONF_MACHTYPE='"Mac"' -DMACOSX -DSHELL -DHAVE_CONFIG_H -fmessage-length=0 -mtune=G4 -gdwarf-2 -I/tmp/bash-fix/bash-92/build/bash.build/Release/intl.build/intl.hmap -F/tmp/bash-fix/bash-92/build/Release -I/tmp/bash-fix/bash-92/build -I. -Ibash-3.2 -Idoc -Ibash-3.2/builtins -Ibash-3.2/cross-build -Ibash-3.2/CWRU -Ibash-3.2/doc -Ibash-3.2/examples -Ibash-3.2/include -Ibash-3.2/lib -Ibash-3.2/po -Ibash-3.2/support -Ibash-3.2/tests -Ibash-3.2/CWRU/misc -Ibash-3.2/examples/bashdb -Ibash-3.2/examples/complete -Ibash-3.2/examples/functions -Ibash-3.2/examples/loadables -Ibash-3.2/examples/misc -Ibash-3.2/examples/obashdb -Ibash-3.2/examples/scripts -Ibash-3.2/examples/scripts.noah -Ibash-3.2/examples/scripts.v2 -Ibash-3.2/examples/startup-files -Ibash-3.2/lib/glob -Ibash-3.2/lib/intl -Ibash-3.2/lib/malloc -Ibash-3.2/lib/readline -Ibash-3.2/lib/sh -Ibash-3.2/lib/termcap -Ibash-3.2/lib/tilde -Ibash-3.2/tests/misc -Ibash-3.2/examples/loadables/perl -Ibash-3.2/examples/startup-files/apple -Ibash-3.2/lib/glob/doc -Ibash-3.2/lib/readline/doc -Ibash-3.2/lib/readline/examples -Ibash-3.2/lib/termcap/grot -I/tmp/bash-fix/bash-92/build/Release/include -I/tmp/bash-fix/bash-92/build/bash.build/Release/intl.build/DerivedSources -c /tmp/bash-fix/bash-92/bash-3.2/lib/intl/dcgettext.c -o /tmp/bash-fix/bash-92/build/bash.build/Release/intl.build/Objects-normal/ppc/dcgettext.o

CompileC build/bash.build/Release/intl.build/Objects-normal/ppc/dcigettext.o /tmp/bash-fix/bash-92/bash-3.2/lib/intl/dcigettext.c normal ppc c com.apple.compilers.gcc.4_0
cd /tmp/bash-fix/bash-92
/Developer/usr/bin/gcc-4.0 -x c -arch ppc -pipe -std=gnu99 -Wno-trigraphs -fpascal-strings -fasm-blocks -Os -Werror-implicit-function-declaration -Wreturn-type -Wunused-variable -DM_UNIX -DIN_LIBINTL -DLIBDIR='"/usr/libdata"' -DLOCALEDIR='"/usr/share/locale"' -DLOCALE_ALIAS_PATH='"/usr/share/locale"' -DPACKAGE='"BASH"' -DSSH_SOURCE_BASHRC -DCONF_VENDOR='"apple"' -DCONF_MACHTYPE='"Mac"' -DMACOSX -DSHELL -DHAVE_CONFIG_H -fmessage-length=0 -mtune=G4 -gdwarf-2 -I/tmp/bash-fix/bash-92/build/bash.build/Release/intl.build/intl.hmap -F/tmp/bash-fix/bash-92/build/Release -I/tmp/bash-fix/bash-92/build -I. -Ibash-3.2 -Idoc -Ibash-3.2/builtins -Ibash-3.2/cross-build -Ibash-3.2/CWRU -Ibash-3.2/doc -Ibash-3.2/examples -Ibash-3.2/include -Ibash-3.2/lib -Ibash-3.2/po -Ibash-3.2/support -Ibash-3.2/tests -Ibash-3.2/CWRU/misc -Ibash-3.2/examples/bashdb -Ibash-3.2/examples/complete -Ibash-3.2/examples/functions -Ibash-3.2/examples/loadables -Ibash-3.2/examples/misc -Ibash-3.2/examples/obashdb -Ibash-3.2/examples/scripts -Ibash-3.2/examples/scripts.noah -Ibash-3.2/examples/scripts.v2 -Ibash-3.2/examples/startup-files -Ibash-3.2/lib/glob -Ibash-3.2/lib/intl -Ibash-3.2/lib/malloc -Ibash-3.2/lib/readline -Ibash-3.2/lib/sh -Ibash-3.2/lib/termcap -Ibash-3.2/lib/tilde -Ibash-3.2/tests/misc -Ibash-3.2/examples/loadables/perl -Ibash-3.2/examples/startup-files/apple -Ibash-3.2/lib/glob/doc -Ibash-3.2/lib/readline/doc -Ibash-3.2/lib/readline/examples -Ibash-3.2/lib/termcap/grot -I/tmp/bash-fix/bash-92/build/Release/include -I/tmp/bash-fix/bash-92/build/bash.build/Release/intl.build/DerivedSources -c /tmp/bash-fix/bash-92/bash-3.2/lib/intl/dcigettext.c -o /tmp/bash-fix/bash-92/build/bash.build/Release/intl.build/Objects-normal/ppc/dcigettext.o
/tmp/bash-fix/bash-92/bash-3.2/lib/intl/dcigettext.c:302:36: warning: character constant too long for its type
/tmp/bash-fix/bash-92/bash-3.2/lib/intl/dcigettext.c:302: error: invalid initializer
** BUILD FAILED **
 

Intell

macrumors P6
Jan 24, 2010
18,955
509
Inside
What version of Xcode do you have installed? You can find out by running "xcodebuild -version" in Terminal.
 

Intell

macrumors P6
Jan 24, 2010
18,955
509
Inside
That version of Xcode is too old to properly build bash and sh. You need at least version 3.1. You can download the last version for Leopard by going to https://developer.apple.com/downloads/index.action and signing it with your free developer account or your Apple ID, then searching for "Xcode 3.1.4". Download the 993.04MB DMG to your OS X 10.5.8 machine and then install it. Once installed, start over with building bash and sh.
 

roadbloc

macrumors G3
Original poster
Aug 24, 2009
8,784
215
UK
Fixed

I tried out the solution on the TenFourFox page since I didn't have XCode (or Leopard) and I'm happy to report it works perfectly too. Glad we have a few fixes for this around now. :)

I'll post the TenFourFox blog solution here for y'all to use.
Code:
 Bashing bash one more time: updated universal 4.3.26 covering both bash flaws
See the previous entry, but in short, bash has been shown to have a pretty nasty little vulnerability that causes it to inadvertently execute shell commands in the environment you pass it. This attack does work on Power Macs because most shell commands are cross-platform, and appears to exist on all versions of OS X.

The solution is easy: build a new bash from the newly patched source code. As a service to you, I have done so, and compiled it for PowerPC and Intel so it will also work for users on 10.6 who are not receiving updates either. The version earlier today had a preliminary version of the patch which does not fix a second variant vulnerability. This version does. If you used one of the "build from source" tricks that were circulating earlier today (MacRumors, etc.), your version does NOT have this second issue patched. Either wait for the public source trees to update and rebuild it (likely early tomorrow), or use this one.

The bash these steps will install works on 10.4 all the way to 10.9 on 32-bit Intel, 64-bit Intel and PowerPC. It requires no other dependencies. The idea is to replace your system bash -- yes, you can use Homebrew, Tigerbrew, MacPorts, etc., to get an updated copy, but your built-in bash is still vulnerable unless you replace it. This is designed to accomplish that. WARNING AGAIN: If you are not comfortable with the Terminal, get someone to help you!

    In a Terminal.app window, verify that you have a vulnerable system so that you can see what that looks like (the command is all one line):

    env x='() { :;}; echo vulnerable' bash -c "echo this is a test"

    It should print

    vulnerable
    this is a test

    Check the second vulnerability. This creates a file called echo with the date in it, if your system is vulnerable:

    env X='() { (a)=>\' sh -c "echo date"; cat echo

    It should print something like (the messages and of course the time will vary):

    bash: X: line 1: syntax error near unexpected token `='
    bash: X: line 1: `'
    bash: error importing function definition for `X'
    Thu Sep 25 22:12:49 PDT 2014

    (Delete the file it makes before you continue! rm echo)

    Download the patched bash 4.3.26. Put it in your home directory. If necessary, double-click to decompress it so that you have a file in your home directory called bash-4.3.26-10.4u.

    Close all terminal windows and programs just to make sure you won't stomp on bash while a program is trying to call it. Start Terminal and have exactly one window open.

    In that terminal window:

        exec tcsh
        chmod +x bash-4.3.26-10.4u

        If you replaced /bin/bash (and/or /bin/sh) with the patch earlier today, DO NOT DO THE NEXT TWO COMMANDS. If you have not already replaced them, go ahead; these will put the old ones in a safe place, just in case.

        sudo mv /bin/bash /bin/bash_old (enter your password)
        sudo mv /bin/sh /bin/sh_old (enter your password if needed)

        Everybody does these:

        sudo cp bash-4.3.26-10.4u /bin/bash (enter your password if needed)
        sudo cp bash-4.3.26-10.4u /bin/sh (enter your password if needed)

    Test it stuck by trying the statements again:

    env x='() { :;}; echo vulnerable' bash -c "echo this is a test"

    It should print

    bash: warning: x: ignoring function definition attempt
    bash: error importing function definition for `x'
    this is a test

    Now, try the second one:

    env X='() { (a)=>\' sh -c "echo date"; cat echo

    It should print

    bash: X: line 1: syntax error near unexpected token `='
    bash: X: line 1: `'
    bash: error importing function definition for `X'
    date
    cat: echo: No such file or directory

    Restart your Mac as a paranoia to make sure everything is using the new copy of bash.

    Bask in the glow. Then, find a shell that doesn't suck.
 

Attachments

  • fixedbash.png
    fixedbash.png
    22.3 KB · Views: 197

vlark

macrumors member
Mar 13, 2014
97
0
The directions from the TenFourFox blog say "home directory". Is he talking about something in Unix, or just the base USER directory for an admin account, where all your Mac OS folder like documents, music, etc. are?
 

roadbloc

macrumors G3
Original poster
Aug 24, 2009
8,784
215
UK
The directions from the TenFourFox blog say "home directory". Is he talking about something in Unix, or just the base USER directory for an admin account, where all your Mac OS folder like documents, music, etc. are?

Yes he is talking about the OS X user directory. The default place that Terminal (and Finder) opens to.

/Users/<username>/

:)
 

2984839

Cancelled
Apr 19, 2014
2,114
2,240
For most users' computers, it's something that should not be worried about, but should be fixed as soon as possible.

For servers, it's something that should be worried about extensively and should be fixed immediately.

Of course, you'd have to be utterly insane to connect a computer with 10.5 or earlier to the open internet in the first place. In any case, if you follow the guidelines in this thread or at TenFourFox, you'll have it fixed.
 

Anonymous Freak

macrumors 603
Dec 12, 2002
5,568
1,270
Cascadia
For most users' computers, it's something that should not be worried about, but should be fixed as soon as possible.

For servers, it's something that should be worried about extensively and should be fixed immediately.

Of course, you'd have to be utterly insane to connect a computer with 10.5 or earlier to the open internet in the first place. In any case, if you follow the guidelines in this thread or at TenFourFox, you'll have it fixed.

Exactly.

Solution if you can't/won't compile the update yourself:
1. Make sure your PPC system is connecting to the internet via a secure link (wired Ethernet or WPA WiFi, not WEP or open WiFi.)
2. Ensure that your PPC system is connecting through a router with NAT and a Firewall.
3. Ensure that your system is *NOT* configured as the "Default host", "DMZ", etc. within your router.
4. Ensure that there are no ports being forwarded in your router to your PPC system.
5. Disable all types of sharing on your PPC system other than those that you *MUST* have for your workflow. (At this point, your PPC system running an old version of OS X should *NOT* be a server.)
- If possible, disable *ALL* sharing from the PPC side, and open shares on the other machine so your PPC connects TO the other machine, rather than the other machine connecting to your PPC.
6. Disable "Remote Management".
7. Turn on OS X's firewall, with maximum security that is usable for your setup.
8. Enable "Stealth mode" in the OS X firewall.
9. Block all incoming connections in the OS X firewall.

Note, this is important for any PPC system that can access the internet. If you are using it on a purely-internal network with no internet connectivity, go ahead and do whatever you want.

As I said after #5, you should not be using a PPC system running OS X as an internet-facing server. OS X 10.5 and earlier is missing many security updates that are vital on an internet-facing server.
 

tom vilsack

macrumors 68000
Nov 20, 2010
1,880
63
ladner cdn
Guess a good idea to do with my Tiger Ti powerbook...but isn't it already pretty open to security risks as having not been supported for years....
 

2984839

Cancelled
Apr 19, 2014
2,114
2,240
Guess a good idea to do with my Tiger Ti powerbook...but isn't it already pretty open to security risks as having not been supported for years....

For an OS as old as that, the Bash vulnerability is probably relatively minor in the grand scheme of things, unless you are operating a server, have some system scripts that invoke Bash and use untrusted inputs from the internet, or allow remote SSH access.

Still, it's fixable and not a huge amount of work, so it's worth fixing.
 

robertdsc

macrumors regular
Jan 28, 2014
202
9
I tried the TFF blog fix and messed up Terminal. I had to re-install Snow Leopard from scratch and re-import everything. Needless to say, I'm not going to mess with this on Tiger or Leopard.

I hate command lines.
 
Last edited:
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.