OSX: bash的更新

本文尽量详述目前来说的bash补丁的进展，从下面4个方面解释：

• 最全最新的更新安装包,：Oct 5为止的
• 测试已知的bash漏洞的脚本：更新后可以用来检测已知bash漏洞的情况
• 脚本编译更新版本：也可以更新到3.2.56版本，需要在本地编译
• 手动更新：看这个部分，可以详细了解目前状态。遇到未来的更新，也可以手动自己更新。

1. 最全最新的更新安装包：

最近犹他大学(University of Utah)的Richard Glaser发布了自己开发的一个集成适合于OS X从10.5到10.10的bash更新包，它将bash更新到目前最新的3.2.56版本, 相比较Apple官方的3.2.53(1)要信，而且修复了（宣称的，因为目前没有更多的信息显示56版本是否真正修复了）那些已知的危险漏洞（后面列出，并有脚本测试）。可以在csdn下载，这里。

下面是公布的原文：

Here is a OS X installer for the latest official GNU bash release version, 3.2.56 and will be updated to new releases when available. The bash is universal runs on 32/64-bit, PowerPC, Intel architectures and supports and has been tested on OS X 10.5 thur OS X 10.10 http://www.mac-mgrs.utah.edu/ downloads/osx_gnu_bash_ installer.zip Our institution is very decentralized and primarily there was a need to apply latest GNU bash patch to non=Apple supported OS’s like OS 10.6/10.5, but for those security conscious or paranoid could use it on supported OS X versions. Here is the SHA1 256 checksums •        OS X 10.5-10.10 - bash version 3.2.56          bed4178f4bdf05ad2d5c396fb3ed97 331e62e35836fae1410e20f0e05a77 c13e         •        OS X 10.5-10.10 - sh version 3.2.56          f51a83aaad5d15b34753998cb81061 eb63ffe1a28f8876db0a0ea2f04f28 e3b1 The installer backups current bash install incase you need to revert back to previous version. See installer read me for details. Hope this is useful to the community. Let me know if you have any suggestions, comments or problems.

2. 测试已知的bash漏洞：

另外一个技术人员，编写了一个检查目前可知的bash漏洞的脚本，原脚本可以从这里获得。为了方便阅读，在最后附上。下面是使用该脚本测试上面3.2.56版本的补丁结果：

<span style="font-family: Arial, Helvetica, sans-serif;">$ bashcheck.shTesting /bin/bash ...GNU bash, version 3.2.56(1)-release (x86_64-apple-darwin9)Variable function parser pre/suffixed [%%, upstream], bugs not exploitableNot vulnerable to CVE-2014-6271 (original shellshock)Not vulnerable to CVE-2014-7169 (taviso bug)Not vulnerable to CVE-2014-7186 (redir_stack bug)Test for CVE-2014-7187 not reliable without address sanitizerNot vulnerable to CVE-2014-6277 (lcamtuf bug #1)Not vulnerable to CVE-2014-6278 (lcamtuf bug #2)</span>

相比较Apple官方的3.2.53(1)的检测结果：

$ ./bashbash.sh Testing /bin/bash ... GNU bash, version 3.2.53(1)-release (x86_64-apple-darwin14) Not vulnerable to CVE-2014-6271 (original shellshock) Not vulnerable to CVE-2014-7169 (taviso bug) Vulnerable to CVE-2014-7186 (redir_stack bug) Test for CVE-2014-7187 not reliable without address sanitizer Vulnerable to CVE-2014-6277 (lcamtuf bug #1) [no patch] Not vulnerable to CVE-2014-6278 (lcamtuf bug #2) Variable function parser inactive, likely safe from unknown parser bugs

3. 自己编译更新版本

另外，TJ Luoma发布了一个脚本，它从opensource.apple.com网站下载的最新bash源程序，并从gnu.org上下载各个更新补丁，使用xcode来为之重新编译。目前它也是3.2.56版本。

4.手动更新

这个是如何手动的解释，详细查看AlBlue的解释。

--------------------------------------------------

bash-check脚本

#!/bin/bashwarn() {if [ "$scary" == "1" ]; thenecho -e "\033[91mVulnerable to $1\033[39m"elseecho -e "\033[93mFound non-exploitable $1\033[39m"fi}good() {echo -e "\033[92mNot vulnerable to $1\033[39m"}[ -n "$1" ] && bash=$(which $1) || bash=$(which bash)echo -e "\033[95mTesting $bash ..."echo $($bash --version | head -n 1)echo -e "\033[39m"#r=`a="() { echo x;}" $bash -c a 2>/dev/null`if [ -n "$(env 'a'="() { echo x;}" $bash -c a 2>/dev/null)" ]; thenecho -e "\033[91mVariable function parser active, maybe vulnerable to unknown parser bugs\033[39m"scary=1elif [ -n "$(env 'BASH_FUNC_a%%'="() { echo x;}" $bash -c a 2>/dev/null)" ]; thenecho -e "\033[92mVariable function parser pre/suffixed [%%, upstream], bugs not exploitable\033[39m"scary=0elif [ -n "$(env 'BASH_FUNC_a()'="() { echo x;}" $bash -c a 2>/dev/null)" ]; thenecho -e "\033[92mVariable function parser pre/suffixed [(), redhat], bugs not exploitable\033[39m"scary=0elif [ -n "$(env 'BASH_FUNC_<a>%%'="() { echo x;}" $bash -c a 2>/dev/null)" ]; thenecho -e "\033[92mVariable function parser pre/suffixed [<..>%%, apple], bugs not exploitable\033[39m"scary=0elseecho -e "\033[92mVariable function parser inactive, bugs not exploitable\033[39m"scary=0fir=`env x="() { :; }; echo x" $bash -c "" 2>/dev/null`if [ -n "$r" ]; thenwarn "CVE-2014-6271 (original shellshock)"elsegood "CVE-2014-6271 (original shellshock)"ficd /tmp;rm echo 2>/dev/nullenv x='() { function a a>\' $bash -c echo 2>/dev/null > /dev/nullif [ -e echo ]; thenwarn "CVE-2014-7169 (taviso bug)"elsegood "CVE-2014-7169 (taviso bug)"fi$($bash -c "true $(printf '<<EOF %.0s' {1..80})" 2>/tmp/bashcheck.tmp)ret=$?grep -q AddressSanitizer /tmp/bashcheck.tmpif [ $? == 0 ] || [ $ret == 139 ]; thenwarn "CVE-2014-7186 (redir_stack bug)"elsegood "CVE-2014-7186 (redir_stack bug)"fi$bash -c "`for i in {1..200}; do echo -n "for x$i in; do :;"; done; for i in {1..200}; do echo -n "done;";done`" 2>/dev/nullif [ $? != 0 ]; thenwarn "CVE-2014-7187 (nested loops off by one)"elseecho -e "\033[96mTest for CVE-2014-7187 not reliable without address sanitizer\033[39m"fi$($bash -c "f(){ x(){ _;};x(){ _;}<<a;}" 2>/dev/null)if [ $? != 0 ]; thenwarn "CVE-2014-6277 (lcamtuf bug #1)"elsegood "CVE-2014-6277 (lcamtuf bug #1)"fiif [ -n "$(env x='() { _;}>_[$($())] { echo x;}' $bash -c : 2>/dev/null)" ]; thenwarn "CVE-2014-6278 (lcamtuf bug #2)"elif [ -n "$(env BASH_FUNC_x%%='() { _;}>_[$($())] { echo x;}' $bash -c : 2>/dev/null)" ]; thenwarn "CVE-2014-6278 (lcamtuf bug #2)"elif [ -n "$(env 'BASH_FUNC_x()'='() { _;}>_[$($())] { echo x;}' $bash -c : 2>/dev/null)" ]; thenwarn "CVE-2014-6278 (lcamtuf bug #2)"elsegood "CVE-2014-6278 (lcamtuf bug #2)"fi

bash-fix脚本

#!/bin/zsh -f# recompile bash -# http://apple.stackexchange.com/questions/146849/how-do-i-recompile-bash-to-avoid-the-remote-exploit-cve-2014-6271-and-cve-2014-7/146851#146851## From:Timothy J. Luoma# Mail:luomat at gmail dot com# Date:2014-09-25, Updated 2014-09-29NAME="bash-fix.sh"# This should match Xcode in many variations, betas, etc.XCODE=`find /Applications -maxdepth 1 -type d -iname xcode\*.app -print`if [[ "$XCODE" == "" ]]thenecho "$NAME [FATAL]: Xcode is required, but not installed. Please install Xcode from the Mac App Store."open 'macappstore://itunes.apple.com/us/app/xcode/id497799835?mt=12'exit 1fizmodload zsh/datetimefunction timestamp { strftime "%Y-%m-%d--%H.%M.%S" "$EPOCHSECONDS" }function log { echo "$NAME [`timestamp`]: $@" | tee -a "$LOG" }function die{echo "\n$NAME [FATAL]: $@"exit 1}function msg{echo "\n$NAME [INFO]: $@"}TIME=$(strftime "%Y-%m-%d-at-%H.%M.%S" "$EPOCHSECONDS")LOG="$HOME/Library/Logs/$NAME.$TIME.txt"[[ -d "$LOG:h" ]] || mkdir -p "$LOG:h"[[ -e "$LOG" ]]   || touch "$LOG"cd "$HOME/Desktop" || cdmkdir -p bash-fixcd bash-fixORIG_DIR="$PWD"##################################################################################################msg "Downloading and uncompressing Apple's 'bash' source code..."curl --progress-bar -fL https://opensource.apple.com/tarballs/bash/bash-92.tar.gz | tar zxf -EXIT="$?"if [ "$EXIT" = "0" ]thenmsg "Successfully downloaded bash source from Apple.com"elsedie "curl or tar failed (\$EXIT = $EXIT)"ficd bash-92/bash-3.2msg "CWD is now $PWD"##################################################################################################msg "Downloading and applying bash32-052 from gnu.org..."curl --progress-bar -fL https://ftp.gnu.org/pub/gnu/bash/bash-3.2-patches/bash32-052 | patch -p0EXIT="$?"if [ "$EXIT" = "0" ]thenmsg "patch bash32-052 successfully applied"elsedie "patch bash32-052 FAILED"fi##################################################################################################msg "Downloading and applying bash32-053 from gnu.org..."curl --progress-bar -fL https://ftp.gnu.org/pub/gnu/bash/bash-3.2-patches/bash32-053 | patch -p0EXIT="$?"if [ "$EXIT" = "0" ]thenmsg "patch bash32-053 successfully applied"elsedie "patch bash32-053 FAILED"fi##################################################################################################msg "Downloading and applying bash32-054 from gnu.org..."curl --progress-bar -fL https://ftp.gnu.org/pub/gnu/bash/bash-3.2-patches/bash32-054 | patch -p0EXIT="$?"if [ "$EXIT" = "0" ]thenmsg "patch bash32-054 successfully applied"elsedie "patch bash32-054 FAILED"fi##################################################################################################msg "Downloading and applying bash32-055 from gnu.org..."curl --progress-bar -fL https://ftp.gnu.org/pub/gnu/bash/bash-3.2-patches/bash32-055 | patch -p0EXIT="$?"if [ "$EXIT" = "0" ]thenmsg "patch bash32-055 successfully applied"elsedie "patch bash32-055 FAILED"fi##################################################################################################msg "Downloading and applying bash32-056 from gnu.org..."curl --progress-bar -fL https://ftp.gnu.org/pub/gnu/bash/bash-3.2-patches/bash32-056 | patch -p0EXIT="$?"if [ "$EXIT" = "0" ]thenmsg "patch bash32-056 successfully applied"elsedie "patch bash32-056 FAILED"fi##################################################################################################cd ..msg "CWD is now $PWD"echo -n "$NAME is about to run xcodebuild and its output redirected to $ORIG_DIR/xcodebuild.log. If it does not succeed, check the log for error messages.\n\nThis could take a few minutes. Please wait... "xcodebuild 2>&1 >>| "$ORIG_DIR/xcodebuild.log"EXIT="$?"if [ "$EXIT" = "0" ]thenmsg "xcodebuild exited successfully."elsedie "xcodebuild failed (\$EXIT = $EXIT). See $ORIG_DIR/xcodebuild.log for details."exit 1fi# Play a sound to tell them the build finished[[ -e /System/Library/Sounds/Glass.aiff ]] && afplay /System/Library/Sounds/Glass.aiffif [ -e 'build/Release/bash' ]thenmsg "Here is the _NEW_ version number for bash (must be 3.2.52(1) or later):"build/Release/bash --version # GNU bash, version 3.2.54(1)-release (x86_64-apple-darwin13)elsedie "build/Release/bash does not exist. See $PWD/xcodebuild.log for details."fiif [ -e 'build/Release/sh' ]thenmsg "Here is the _NEW_ version number for sh (must be 3.2.52(1) or later):"build/Release/sh --version   # GNU bash, version 3.2.54(1)-release (x86_64-apple-darwin13)elsedie "build/Release/sh does not exist. See $PWD/xcodebuild.log for details."fi###################################################################################### 2014-09-29: disabled test section because it only tests first vulnerability.# 2014-09-29: TODO: Add tests for each vulnerability to verify it was fixed## $NAME: About to run test of new bash:## You should see 'hello' but you should NOT see the word 'vulnerable':## Press Return/Enter to run test: "## read PROMPT_TO_CONTINUE## env x='() { :;}; echo vulnerable' build/Release/bash -c 'echo hello' 2>/dev/nullecho "\n\n"read "?$NAME: Ready to install newly compiled 'bash' and 'sh'? [Y/n]: " ANSWERcase "$ANSWER" inN*|n*)echo "$NAME: OK, not installing"exit 0;;esaccat <<EOINPUT$NAME: About to replace the vulnerable versions of /bin/bash and /bin/sh with the new, patched versions.The.$TIME ones will be backed up to /bin/bash.$TIME and /bin/sh.$TIME respectivelyPlease enter your administrator password (if prompted):EOINPUT# This will prompt user for admin passwordsudo -v##################################################################################################msg "Moving /bin/bash to /bin/bash.$TIME: "sudo /bin/mv -vf /bin/bash "/bin/bash.$TIME"|| die "Failed to move /bin/bash to /bin/bash.$TIME"msg "Installing build/Release/bash to /bin/bash: "sudo cp -v build/Release/bash /bin/bashif [ "$?" != "0" ]thensudo mv -vf "/bin/bash.$TIME" /bin/bashdie "Failed to move build/Release/bash to /bin/bash. Restored /bin/bash.$TIME to /bin/bash"fi##################################################################################################msg "Moving /bin/sh to /bin/sh.$TIME: "sudo /bin/mv -vf /bin/sh   "/bin/sh.$TIME" || die "Failed to move /bin/sh to /bin/sh.$TIME"msg "Installing build/Release/sh to /bin/sh: "sudo cp -v build/Release/sh /bin/shif [ "$?" != "0" ]thensudo mv -vf "/bin/sh.$TIME" /bin/shdie "Failed to move build/Release/sh to /bin/sh. Restored /bin/sh.$TIME to /bin/sh"fi##################################################################################################msg "Removing executable bit from /bin/bash.$TIME"sudo /bin/chmod a-x "/bin/bash.$TIME" \ || msg "WARNING: Failed to remove executable bit from /bin/bash.$TIME"msg "Removing executable bit from /bin/sh.$TIME"sudo /bin/chmod a-x "/bin/sh.$TIME" \|| msg "WARNING: Failed to remove executable bit from /bin/sh.$TIME"msg "$NAME has finished successfully."read "?Do you want to move $ORIG_DIR to ~/.Trash/? [Y/n]  " ANSWERcase "$ANSWER" inN*|n*)echo "$NAME: Not moving $ORIG_DIR."exit 0;;*)mv -vn "$ORIG_DIR" "$HOME/.Trash/$ORIG_DIR.$EPOCHSECONDS"exit 0;;esacexit##EOF