Re: Shellshock in zsh

[Chet Ramey <chet.ramey@xxxxxxxx>]

On 9/25/14, 9:29 AM, Boyan Penkov wrote:
> Hey folks,
> 
> I’m writing to ask about zsh and Shellshock.  Since bash is affected, is zsh affected as well?  Two of us took a look, and we think it may be.
> 
> Specifically, following these steps — https://access.redhat.com/articles/1200223 — in zsh 5.0.6 on OS 10.9.5 and zsh 5.0.2 on OS 10.9.4 yields the “vulnerable” output.

zsh is not vulnerable; it does not use the environment to export functions.
The example

env x='() { :;}; echo vulnerable'  bash -c "echo this is a test"
                                   ^^^^
                                   ||||

runs bash with the specially-crafted variable in the environment regardless
of the shell you use to execute that command line.

-- 
``The lyf so short, the craft so long to lerne.'' - Chaucer
		 ``Ars longa, vita brevis'' - Hippocrates
Chet Ramey, ITS, CWRU    chet@xxxxxxxx    http://cnswww.cns.cwru.edu/~chet/