本文尽量详述眼下来说的bash补丁的进展,从以下4个方面解释:
- 最全最新的更新安装包,:Oct 5为止的
- 測试已知的bash漏洞的脚本:更新后能够用来检測已知bash漏洞的情况
- 脚本编译更新版本号:也能够更新到3.2.56版本号,须要在本地编译
- 手动更新:看这个部分,能够具体了解眼下状态。遇到未来的更新。也能够手动自己更新。
1. 最全最新的更新安装包:
近期犹他大学(University of Utah)的Richard Glaser公布了自己开发的一个集成适合于OS X从10.5到10.10的bash更新包。它将bash更新到眼下最新的3.2.56版本号, 相比較Apple官方的3.2.53(1)要信,并且修复了(宣称的。由于眼下没有很多其它的信息显示56版本号是否真正修复了)那些已知的危急漏洞(后面列出,并有脚本測试)。能够在csdn下载。这里。
以下是发布的原文:
Here is a OS X installer for the latest official GNU bash release version, 3.2.56 and will be updated to new releases when available. The bash is universal runs on 32/64-bit, PowerPC, Intel architectures and supports and has been tested on OS X 10.5 thur OS X 10.10 http://www.mac-mgrs.utah.edu/ downloads/osx_gnu_bash_ installer.zip Our institution is very decentralized and primarily there was a need to apply latest GNU bash patch to non=Apple supported OS’s like OS 10.6/10.5, but for those security conscious or paranoid could use it on supported OS X versions. Here is the SHA1 256 checksums • OS X 10.5-10.10 - bash version 3.2.56 bed4178f4bdf05ad2d5c396fb3ed97 331e62e35836fae1410e20f0e05a77 c13e • OS X 10.5-10.10 - sh version 3.2.56 f51a83aaad5d15b34753998cb81061 eb63ffe1a28f8876db0a0ea2f04f28 e3b1 The installer backups current bash install incase you need to revert back to previous version. See installer read me for details. Hope this is useful to the community. Let me know if you have any suggestions, comments or problems.
2. 測试已知的bash漏洞:
另外一个技术人员。编写了一个检查眼下可知的bash漏洞的脚本,原脚本能够从这里获得。
为了方便阅读。在最后附上。以下是使用该脚本測试上面3.2.56版本号的补丁结果:
<span style="font-family: Arial, Helvetica, sans-serif;"> $ bashcheck.sh Testing /bin/bash ... GNU bash, version 3.2.56(1)-release (x86_64-apple-darwin9) Variable function parser pre/suffixed [%%, upstream], bugs not exploitable Not vulnerable to CVE-2014-6271 (original shellshock) Not vulnerable to CVE-2014-7169 (taviso bug) Not vulnerable to CVE-2014-7186 (redir_stack bug) Test for CVE-2014-7187 not reliable without address sanitizer Not vulnerable to CVE-2014-6277 (lcamtuf bug #1) Not vulnerable to CVE-2014-6278 (lcamtuf bug #2)</span>
相比較Apple官方的3.2.53(1)的检測结果:
$ ./bashbash.sh Testing /bin/bash ... GNU bash, version 3.2.53(1)-release (x86_64-apple-darwin14) Not vulnerable to CVE-2014-6271 (original shellshock) Not vulnerable to CVE-2014-7169 (taviso bug) Vulnerable to CVE-2014-7186 (redir_stack bug) Test for CVE-2014-7187 not reliable without address sanitizer Vulnerable to CVE-2014-6277 (lcamtuf bug #1) [no patch] Not vulnerable to CVE-2014-6278 (lcamtuf bug #2) Variable function parser inactive, likely safe from unknown parser bugs
3. 自己编译更新版本号
另外,TJ Luoma公布了一个脚本,它从opensource.apple.com站点下载的最新bash源程序。并从gnu.org上下载各个更新补丁,使用xcode来为之又一次编译。
眼下它也是3.2.56版本号。
4.手动更新
--------------------------------------------------
bash-check脚本
#!/bin/bash warn() { if [ "$scary" == "1" ]; then echo -e "