Re: Does the bash bug have a zsh counterpart?

[shawn wilson <ag4ve.us@xxxxxxxxx>]

On Thu, Sep 25, 2014 at 12:41 PM, Peter Stephenson
<p.stephenson@xxxxxxxxxxx> wrote:
> On Thu, 25 Sep 2014 09:35:01 -0700
> "William G. Scott" <wgscott@xxxxxxxx> wrote:
>> Does any version of zsh have the same issue as bash, reported eg at
>>
>> <http://arstechnica.com/security/2014/09/bug-in-bash-shell-creates-big-security-hole-on-anything-with-nix-in-it/>
>
> No, search the zsh-workers archive at www.zsh.org for the last day or
> so.
>
>> I was thinking of temporarily replacing sh and bash on OS X with zsh
>> until a security fix is offered.
>
> If so, make sure you alias it to sh or otherwise cause it to come up in
> POSIX mode.
>
> Dash might be a better bet as it's more widely used for such things.
>

I wouldn't recommend dash as a solution - there might be other hidden
goodies there - see the recent vmware workstation suid issue caused by
dash thinking they were smarter.