Zsh Mailing List Archive
Messages sorted by:
Re: Does the bash bug have a zsh counterpart?
- X-seq: zsh-users 19152
- From: TJ Luoma <luomat@xxxxxxxxx>
- To: "William G. Scott" <wgscott@xxxxxxxx>
- Subject: Re: Does the bash bug have a zsh counterpart?
- Date: Thu, 25 Sep 2014 13:29:01 -0400
- Cc: Peter Stephenson <p.stephenson@xxxxxxxxxxx>, Zsh-Users List <zsh-users@xxxxxxx>
- Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type:content-transfer-encoding; bh=0MHpDetC1Eip4KweKaXEKpjUOvWwWXbL3p4x7wEM3CM=; b=IyPjki25nyUWNVwwIqeRbCmYNbEFWrBnitfsYUjMOWuj/6fJpsRLPBt34jJP3SLuYu e5geNW6QIzaSxghUJPkD2GMPZ1dRx+bMHOcrrZPsuimcnUMpmtJWvOWJ393FfD869yn8 1eTwnBtFTq8o4GMz5dU7l5a45hoizq6c3tY/0HuA7Fq7phEt2ZSk4mJswcFBoy77BQpr 7fG2x0oGtvJswpNwxpXLedjpaVmLuY4NGxpvPB+9cPqHn2LomPHlZkZhhB3ywvkrikBh wzRCdlzmFncgk2v/Auayn/BjcWSaWJyFTp+8CixTL0HCslaeg+8ALGlIigmiK3/eNXKj X7ww==
- In-reply-to: <30A8659B-9D25-4A83-BCA6-829A25FCA89D@ucsc.edu>
- List-help: <mailto:email@example.com>
- List-id: Zsh Users List <zsh-users.zsh.org>
- List-post: <mailto:firstname.lastname@example.org>
- Mailing-list: contact zsh-users-help@xxxxxxx; run by ezmlm
- References: <1B204EC0-006C-47D9-80F3-007562954A8D@ucsc.edu> <email@example.com> <30A8659B-9D25-4A83-BCA6-829A25FCA89D@ucsc.edu>
I realize this is pretty nearly off-topic but considering the
seriousness of this bug I’ll mention it anyway:
If you use OS X there are instructions on building your own version
from (patched) source here
I have used that to make a (zsh!) shell script here:
But do note that there is another bash vulnerability (mentioned on the
StackExchange site) which has yet to be patched. I’ll be updating my
GitHub script as new patches become available until Apple releases an
On Thu, Sep 25, 2014 at 12:53 PM, William G. Scott <wgscott@xxxxxxxx> wrote:
> On Sep 25, 2014, at 9:41 AM, Peter Stephenson <p.stephenson@xxxxxxxxxxx> wrote:
>> On Thu, 25 Sep 2014 09:35:01 -0700
>> "William G. Scott" <wgscott@xxxxxxxx> wrote:
>>> Does any version of zsh have the same issue as bash, reported eg at
>> No, search the zsh-workers archive at www.zsh.org for the last day or
>>> I was thinking of temporarily replacing sh and bash on OS X with zsh
>>> until a security fix is offered.
>> If so, make sure you alias it to sh or otherwise cause it to come up in
>> POSIX mode.
>> Dash might be a better bet as it's more widely used for such things.
> Thanks. I decided to try living life on the edge, backed up the old versions of sh and bash, and made hard links to the system zsh. (About 10 years ago I found a hard link to a then nonexistent ksh behaved properly whereas a symbolic link for whatever reason didn’t). I’ve done this on 10.10b and 10.9 and rebooted and things appear to be working without issue. So far. (At the very least, it might be entertaining to see where this might go wrong.)
Messages sorted by: