Not to whine or anything, but when the question is "how to do I recompile bash" and my answer is "click the following link to the answer to that question, it seems that the summary requirements stand.

Sorry to hear that, Seth. I hope you can solve it; otherwise, you're out of luck. Apple stopped supplying Snow Leopard updates at the end of last year.

EXCELLENT, Seth. Glad to see it!

Apple makes many changes to optimize the open source utils on the system. That said, I can't see where a vanilla bash would somehow fail to behave itself just because the kernel is different. In any case, I consider my solution to be temporary; eventually, Apple will get around to patching the problem and my compiled binaries will be replaced (which is my main reason for compiling into /bin in the first place.

I have an old system with OS X v10.4 and Bash 2.05b, so I can't upgrade to the latest Bash or latest OS X. I followed the instructions here and downloaded the source for Bash 2.05b along with the ten patch files. I applied the patches and built Bash. I needed the kluge for the readline library above. Patch 008 is one of the key patches for this vulnerability, and among other things it fails function definition attempts from environment variables, with the error message internal_warning ("%s: ignoring function definition attempt", from_file);

strings on the newly-built Bash verifies that the new error message ignoring function definition attempt is present. Yet, if I run the new bash and then enter the vulnerability check, it still shows vulnerable.

@jetset: Did you restart the currently open Terminal instance? To test whether things are okay, compare output from bash --version with echo $BASH_VERSION. If the latter is a lower version, restart Terminal.

I didn't install the newly-built Bash; I wanted to verify that it fixed the problem first. So I just invoked it using ./bash and then in it I ran the vulnerability test.

Both the old Bash and the newly-built one report the same version (which makes sense since I manually applied the 2.05 patches): ~/bash/bash-2.05b$ ./bash --version GNU bash, version 2.05b.0(1)-release (powerpc-apple-darwin8.11.0) ~/bash/bash-2.05b$ /bin/bash --version GNU bash, version 2.05b.0(1)-release (powerpc-apple-darwin8.0)

But the newly-built Bash has the new error message while the old Bash doesn't: The new Bash has the string: ~/bash/bash-2.05b$ strings ./bash | grep 'ignoring function definition attempt'%s: ignoring function definition attempt The old Bash does not: ~/bash/bash-2.05b$ strings /bin/bash | fgrep 'ignoring function definition attempt'

If you run the three variations of the vulnerability tests and they do not come up, you're fine. The newest 2.05b patches definitely address these CVEs.

@CousinCocaine: Yes, I might indeed. Thank you.

Can anyone help figure out why a freshly-recompiled Bash 2.05b with all ten patches applied still shows as vulnerable according to the tests? The strings command verifies that the binary has the patches.

@jetset: Did you use the patch command to apply your patches as detailed above? I recall you elsewhere saying that you did your fixes 'manually'.

Yes, I successfully applied all ten patches, as verified by checking the sources. The strings command on the resulting binary shows it has the new error message ignoring function definition attempt which was added by patch 008.

What exactly is the output from running the 3 exploit examples?

The output from each of the three exploit tests is identical on old and patched Bash: $ ./bash $ env x='() { :;}; echo vulnerable' bash -c 'echo hello' vulnerable hello $ rm -f echo $ env X='() { (a)=>\' sh -c "echo date"; cat echo sh: X: line 2: syntax error near unexpected token =' sh: X: line 2: ' sh: error importing function definition for X' Tue Sep 30 17:35:25 PDT 2014 $ env ls="() { echo 'Game over'; }" bash -c ls` Game over