I've recently heard via Twitter about CVE-2014-6271.
Are ordinary OS X desktops, that aren't acting as a web server, at risks of receiving attacks that could exploit this vulnerability?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
The core of this attack is to create an environment variable that looks like a Bash scripting function but ends with the invocation of a program, and then cause Bash to be run. Bash will see the environment variable, parse it, and then keep parsing past the end of the function and run the program.
Any method of triggering Bash execution with at least one attacker-controlled environment variable will work. Web server CGI attacks are getting the attention right now, but a user logging in over SSH could do it (a failed login, however, can't). It's possible that some FTP servers could trigger it (say, through running a post-upload script). A PackageMaker-based installer could trigger it, but if you're running a hostile installer, you've got bigger problems than this. There are probably many other ways as well.
The average desktop user doing average desktop user activities is unlikely to have open attack vectors that could be used to trigger this bug, but Bash shows up in enough unexpected places that it's impossible to say for sure.
What you'd need to do is determine which processes are running bash. On Linux systems, one vulnerability seems to possibly be in how DHCP requests are handled.
You could look at using execsnoop to spot what runs bash and then try doing some normal things - like connecting to a wifi network or browsing webpages that require external helpers (say something like iTunes). See if bash is run and then use some other dtrace tools to see if you can inspect the environments.
However, to be honest, it would make more sense just to update your machine as soon as a fix is available. I haven't seen one yet for OS X (but haven't looked for a few hours), but I'd keep an eye out and update when that happens.
No, as far as I can tell, ordinary OS X desktops are not.
OS X DHCP is not vulnerable. These days it doesn’t even invoke a shell at all, and in the versions that used a bootpd that did invoke a shell, that shell was not Bash; some sites have suggested that it would have been tcsh that was executed, but I think it would actually have been
/bin/sh, which (from memory) on older versions of OS X was BSD’s implementation of the Bourne shell, not Bash.
If you are running Apache and you are using vanilla CGI (which is not normal for an OS X desktop) with Bash, you are vulnerable.
Likewise if you are using an OS X machine to run a restricted SSH server using ForceCommand, you are vulnerable. Again, this is not normal for an OS X desktop.
As for Apple’s various server processes, while I haven’t checked all of them, from memory they tend to use Twisted and then reverse proxy them using Apache. That doesn't involve CGI and isn't vulnerable.