Previewed at WWDC, launching in the fall.
'Bash' Security Flaw in OS X Allows for Malicious Attacks on Devices and Services
Security researchers from Red Hat have uncovered a new exploit in the common "Bash" command shell found in OS X and Linux which can be used to deploy malicious code with minimal effort. Due to the ubiquity of the Bash shell, the exploit can affect a wide variety of different web-connected devices and properties, including unsecured websites, smart home appliances, servers, and more.
Security researcher Robert Graham noted on his blog that the Bash exploit is "as big as Heartbleed," referring to the flaw discovered earlier this year in the popular OpenSSL software which secures connections between clients and servers:
Internet-of-things devices like video cameras are especially vulnerable because a lot of their software is built from web-enabled bash scripts. Thus, not only are they less likely to be patched, they are more likely to expose the vulnerability to the outside world.Heartbleed was said to have affected 66% of the Internet, although Apple announced in April that the exploit did not affect its software or "key services." Apple also released updates for the AirPort Extreme and Time Capsule to better secure both web devices against Heartbleed.
Unlike Heartbleed, which only affected a specific version of OpenSSL, this bash bug has been around for a long, long time. That means there are lots of old devices on the network vulnerable to this bug. The number of systems needing to be patched, but which won't be, is much larger than Heartbleed.
A topic discussing the Bash exploit on StackExchange also notes that Apple did not include a fix for the bug in its latest round of security updates that came alongside the release of OS X Mavericks 10.9.5 last week. It is possible however that Apple will release a fix for OS X in the near future to address the exploit, similar to what it has done for other security issues in the past.
[ 186 comments ]
Top Rated Comments
(View all)
49 months ago
strike three. you're out...
now what?
*still waiting for iPhone + Apple Watch*
*facepalm* you people don't know what bash is do you. this has nothing to do with apple.
49 months ago
Always interesting to find out that a security bug like this has been around for years and no one knew about it until just now.
If only Bash would have been open source so people could search bugs in the source code
/s
49 months ago
Always interesting to find out that a security bug like this has been around for years and no one knew about it until just now.
49 months ago
No, as far as I have seen so far the first initial patch didn't actually fix the problem. The fact is that the bug was publicly disclosed yesterday, and you are ranting because there is no patch today, as of yet.
The bug is fixed. The patch is available. Apple could have rolled it out by now.
The GNU people even were so nice to backport the fixes to the ancient version Apple is using because Apple doesn't want code that's licensed with GPL v3.
http://ftp.gnu.org/gnu/bash/bash-3.2-patches/bash32-052
Apple just has to apply the patch and provide a new bash binary through software update. Apple does not have to identify the bug, they don't have to come up with a solution, they don't have to verify the fix. Everything is done already.
Stupid politics are the only thing that prevent the release of this bugfix. Probably because they like to bundle patches so people think their software is more secure because it isn't patched that often.
49 months ago
I guess this could be the one time that Microsoft fans can say to OS X and Linux (really any 'NIX) fans that Windows DOESN'T have a flaw that IS present on OS X, Linux and any other Unix-based OS.
49 months ago
- iCloud hacks
Last month.
- iOS 8 issues
- iOS 8.0.1 issues
Ok.
- Bentgate
Physics.
- HealthKit issues
Part of 'iOS 8 issues'.
- iPhone 6 RAM issues
Not an issue at all, just some idiots who think RAM is free.
- Free U2 Album issues
Weeks ago.
- Restricted NFC chip
Not an issue, just a business decision that not everyone agrees with.
- Keynote streaming issues
Weeks ago. (Though otherwise valid.)
So yeah, not too bad at all.
49 months ago
Relax, people, the sky is not falling.
This problem primarily affects things running a (web) server.
Your home Mac might technically be affected, but you're likely not running anything that exposes the bug to an attacker.
This problem primarily affects things running a (web) server.
Your home Mac might technically be affected, but you're likely not running anything that exposes the bug to an attacker.
49 months ago
strike three. you're out...
now what?
*still waiting for iPhone + Apple Watch*
now what?
*still waiting for iPhone + Apple Watch*
49 months ago
Last month.
Ok.
Physics.
Part of 'iOS 8 issues'.
Not an issue at all, just some idiots who think RAM is free.
Weeks ago.
Not an issue, just a business decision that not everyone agrees with.
Weeks ago. (Though otherwise valid.)
So yeah, not too bad at all.
Apple apologist alert!
49 months ago
So is this only a problem if SSH sharing is enabled?
This is only a problem if you have something like a server that runs bash scripts that set environment variables to values that come from untrusted sources (e.g. html forms, API calls).
If you are not sure if you are running such a thing you are most likely not directly affected by this.
[ Read All Comments ]
Apple has initiated a new worldwide service program offering free repairs of MacBook and MacBook models equipped with low-profile, butterfly mechanism keyboards, after the company determined that...
Reddit has announced the rollout of its customizable News tab feature to most users of its iOS app. After limited alpha testing of the tab over the last few weeks, Reddit says it has acted on...
A USB-based vulnerability that allows for the brute forcing of a passcode on an iOS device has been discovered by security researcher Matthew Hickey, reports ZDNet.
The method, which bypasses...
For this week's giveaway, we've teamed up with Fuse to offer MacRumors readers a chance to win a Side Winder, which is an accessory that's designed to let you quickly and easily wind up...
Alongside a major version 3.0 update that rolled out to its iOS app [Direct Link] earlier this week, Turner Classic Movies has also expanded support for its "Watch TCM" app to tvOS devices....
Nanoleaf's new 12-sided light-up remote joins its existing Nanoleaf Light Panels and Nanoleaf Rhythm, adding a whole slew of smartphone-free physical control options for your HomeKit setup in one...
Apple Maps vehicles equipped with LiDAR sensors have begun collecting street-level data in Japan for the first time this month.
Apple will be surveying the Tokyo and Urayasu areas between...
Microsoft has announced a new visual search feature for its Bing app that lets users snap a picture with their phone's camera and use it to search the web.
The new visual search function...
