Simple fixes OS X's remote execution of arbitrary code (CVE-2014-6271) Vulnerability

"Any system modifications instruction jobs Jieyou risk, please be responsible for any situation."



Just the other day, broke a more serious than HeartBleed vulnerabilities, number CVE-2014-6271, can execute arbitrary commands on the remote, which can be significant, although the release of Linux Series system update package, most have been released But Unix OS X system architecture, Apple has still not released the update package, but in fact can be used to modify manually, and in this we must describe how to manually update the version to fix bugs Bash



As long as you can sequentially execute the following command, if there is a place you need to enter a password, enter the root password, there is this need to install Xcode

1 mkdir bash
2 cd bash /
3 curl https://opensource.apple.com/tarballs/bash/bash-92.tar.gz | tar zxf -
4 cd bash-92 /
5 cd bash-3.2 /
6 curl https://ftp.gnu.org/pub/gnu/bash/bash-3.2-patches/bash32-052 | patch -p0
7 cd ..
8 xcodebuild
9 cd / bin
10 sudo mv bash bash.old
11 sudo mv sh sh.old
12 cd ~ / bash / bash-92 / build
13 cd Release /
14 sudo cp bash / bin
15 sudo cp sh / bin

The last execution to see:

1 envx = '() {:;}; echo hi'bash-c "echo you_are_gg"