Does the bug in Bash affect Android or iOS mobile systems?
3 Answers
Not out-of-the-box. I know of no Android or iOS device running a bash shell. Some people might, on their rooted devices, but that will be only a few.
-
Isn't /bin/sh based on bash and contain the vulnerability? Because /bin/sh exists on Android.– RoraΖSep 26, 2014 at 14:20
-
2@raz
/bin/sh
is not necessarily the same as bash (though it can be an alias for bash in some cases). In the case of Android, it almost certainly isn't.– Ajedi32Sep 26, 2014 at 18:59
I have run the official test script on my Samsung Galaxy Tab 10.1 and it indicates it is vulnerable. This device was just out of the box and has not been rooted.
Some Aftermarket Android ROMs like CM are vulnerable, because they have the bash shell in their ROMs integrated. CM fixed their Nightlies. I tried the official test script on my Android Devices (all with Custom ROMs) and all were vulnerable.
env x='(){ :;}; echo vulnerable' bash -c "this is a test"
via the app ScriptManager on my Sony XPERIA, it told meenv is not defined
. So i guess no; but still no proof.env
for modifying the environment of your shell called ScriptManager, not that no application on your system relies on Bash and can incidentally or voluntarily let untrusted principals enter commands with a custom environment.