11

Does the bug in Bash affect Android or iOS mobile systems?

  • I believe jailbroken iOS devices can be affected. For instance, the Cydia app store for jailbroken devices installs Bash and other BSD utilities (reference needed). However since you already disable all of the system safeguards and run untrusted software when jailbreaking or rooting, there are other entry points for malware that you already need to take into account. – user56273 Sep 25 '14 at 19:38
  • 1
    I ran the official test-script env x='(){ :;}; echo vulnerable' bash -c "this is a test" via the app ScriptManager on my Sony XPERIA, it told me env is not defined. So i guess no; but still no proof. – marstato Sep 25 '14 at 20:00
  • 1
    Note that the error you get only indicates that there is no method called env for modifying the environment of your shell called ScriptManager, not that no application on your system relies on Bash and can incidentally or voluntarily let untrusted principals enter commands with a custom environment. – Steve Dodier-Lazaro Sep 25 '14 at 21:31
7

Not out-of-the-box. I know of no Android or iOS device running a bash shell. Some people might, on their rooted devices, but that will be only a few.

  • Isn't /bin/sh based on bash and contain the vulnerability? Because /bin/sh exists on Android. – RoraΖ Sep 26 '14 at 14:20
  • 2
    @raz /bin/sh is not necessarily the same as bash (though it can be an alias for bash in some cases). In the case of Android, it almost certainly isn't. – Ajedi32 Sep 26 '14 at 18:59
3

I have run the official test script on my Samsung Galaxy Tab 10.1 and it indicates it is vulnerable. This device was just out of the box and has not been rooted.

0

Some Aftermarket Android ROMs like CM are vulnerable, because they have the bash shell in their ROMs integrated. CM fixed their Nightlies. I tried the official test script on my Android Devices (all with Custom ROMs) and all were vulnerable.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.