Zsh Mailing List Archive
Messages sorted by: Reverse Date, Date, Thread, Author

Re: Does the bash bug have a zsh counterpart?

Maybe not?

I quickly took this:
https://www.reddit.com/r/netsec/comments/2hbxtc/cve20146271_remote_code_execution_through_bash/ckro7be

And changed out the shell. But I didn't look too hard.

 % rm -f echo && env -i  X='() { (a)=>\' zsh -c 'echo date'; cat echo

Downloads/temp swlap1
env: zsh: No such file or directory
cat: echo: No such file or directory

On Thu, Sep 25, 2014 at 12:35 PM, William G. Scott <wgscott@xxxxxxxx> wrote:
> Hi folks:
>
> Does any version of zsh have the same issue as bash, reported eg at
>
> <http://arstechnica.com/security/2014/09/bug-in-bash-shell-creates-big-security-hole-on-anything-with-nix-in-it/>
>
>
> The test listed toward the end of the article doesn’t indicate that it does (substituting zsh for bash), but I just wanted to ask.
>
> I was thinking of temporarily replacing sh and bash on OS X with zsh until a security fix is offered.
>
> Many thanks.
>
>
> Bill
>
>
>
Messages sorted by: Reverse Date, Date, Thread, Author