MacOS – Bash on OS X 10.4 ftp server

bashftpmacos

I am running OS X 10.4 on a G4 using Rumpus software for a FTP server. I keep reading I do not have to worry about Bash Bug if I am not running a web server or other services. does my FTP server qualify as other services. Am I vulnarable

Best Answer

The primary concern would be if you were running Web Sharing with mod_cgi enabled. The other issue is if you have remote login enabled. If the latter is enabled, your system is at risk.

It's unlikely that your system is all that vulnerable. If you have got Xcode's developer tools (including gcc) installed, you might want to give compiling your own binaries a try. The page linked below is chock full of different approaches to solving the particular problem:

How do I recompile Bash to avoid Shellshock (the remote exploit CVE-2014-6271 and CVE-2014-7169)?

For ease, you'd want to retain the same bash base version as you have now, which is likely v2.05b. There are newer versions available, but some differences in behaviour may cause things to break. As such, it's best to take your existing 2.x version and apply the patches available to it. Currently, there are 10 patches released for that version of bash.

Patches can be downloaded here:

https://ftp.gnu.org/gnu/bash/bash-2.05b-patches/

The download of the main 2.05b source is available in the parent directory:

https://ftp.gnu.org/gnu/bash/

In summary: Are you vulnerable? Yes. Is it likely to be serious? No. If you have the skills to fix it yourself, then I recommend doing so. Apple last released a security update for Tiger in Nov 2010. As such, it's unlikely that Apple will ever release an update for that OS version again.

Related Question