Zsh Mailing List Archive Messages sorted by: Reverse Date, Date, Thread, Author

Re: Shellshock in zsh

X-seq: zsh-workers 33246
From: Peter Stephenson <p.stephenson@xxxxxxxxxxx>
To: Boyan Penkov <boyan.penkov@xxxxxxxxx>, zsh-workers@xxxxxxx
Subject: Re: Shellshock in zsh
Date: Thu, 25 Sep 2014 14:35:28 +0100
Cc: Adrian Bradd <ab4042@xxxxxxxxxxxx>
In-reply-to: <9D3C0670-6D81-4DE9-8E34-49D5835C3EA8@gmail.com>
List-help: <mailto:zsh-workers-help@zsh.org>
List-id: Zsh Workers List <zsh-workers.zsh.org>
List-post: <mailto:zsh-workers@zsh.org>
Mailing-list: contact zsh-workers-help@xxxxxxx; run by ezmlm
Organization: Samsung Cambridge Solution Centre
References: <9D3C0670-6D81-4DE9-8E34-49D5835C3EA8@gmail.com>

On Thu, 25 Sep 2014 09:29:08 -0400
Boyan Penkov <boyan.penkov@xxxxxxxxx> wrote:
> I’m writing to ask about zsh and Shellshock.  Since bash is affected,
> is zsh affected as well?  Two of us took a look, and we think it may
> be.
> 
> Specifically, following these steps —
> https://access.redhat.com/articles/1200223 — in zsh 5.0.6 on OS 10.9.5
> and zsh 5.0.2 on OS 10.9.4 yields the “vulnerable” output.

No, it isn't.  See the existing thread starting at:

http://www.zsh.org/mla/workers/2014/msg01016.html

(Hmmm... as the "steps" involve executing bash I'd have thought it was
obvious you needed to try with bash -> zsh inside the command line, but
apparently it isn't.  Is there anyone from redhat not already running
round in circles that would be able to make that clearer?)

pws

-- 
Peter Stephenson <p.stephenson@xxxxxxxxxxx>  Principal Software Engineer
Tel: +44 (0)1223 434724                Samsung Cambridge Solution Centre
St John's House, St John's Innovation Park, Cowley Road,
Cambridge, CB4 0DS, UK

References:
- Shellshock in zsh
  - From: Boyan Penkov

Messages sorted by: Reverse Date, Date, Thread, Author