Kush, Nishchal: software update

9/25/2014

Patching Bash "shellshock" on Apple Mac OS X 10.9.5

Given the recent bash vulnerability disclosure[1] most linux distributions have released patches. Unfortunately Apple still expected users to compile their patches into bash. If you were using Homebrew or Macport you were in better standing and simply had to create symlinks to the patched executables. I've documented the steps I had to take on my Mac desktop.

Compile

mkdir bash
cd bash/
wget http://opensource.apple.com/tarballs/bash/bash-92.tar.gz
tar zxvf bash-92.tar.gz
cd bash-92
cd bash-3.2/
curl https://ftp.gnu.org/pub/gnu/bash/bash-3.2-patches/bash32-052 | patch -p0
curl https://ftp.gnu.org/pub/gnu/bash/bash-3.2-patches/bash32-053 | patch -p0
curl https://ftp.gnu.org/pub/gnu/bash/bash-3.2-patches/bash32-054 | patch -p0
cd ..
xcodebuild

Verify

/bin/bash --version
~/bash/bash-92/build/Release/bash --version

Install

~~sudo mv /bin/bash /bin/bash.vulnerable~~ sudo cp /bin/bash /bin/bash.vulnerable
~~sudo mv /bin/sh /bin/sh.vulnerable~~ sudo cp /bin/sh /bin/sh.vulnerable
sudo chmod 0000 /bin/bash.vulnerable
sudo chmod 0000 /bin/sh.vulnerable
sudo cp ~/bash/bash-92/build/Release/bash /bin/
sudo cp ~/bash/bash-92/build/Release/sh /bin/
/bin/bash --version

References:

https://www.us-cert.gov/ncas/current-activity/2014/09/24/Bourne-Again-Shell-Bash-Remote-Code-Execution-Vulnerability
http://www.theregister.co.uk/2014/09/24/bash_shell_vuln/
https://securityblog.redhat.com/2014/09/24/bash-specially-crafted-environment-variables-code-injection-attack/
https://access.redhat.com/articles/1200223
http://alblue.bandlem.com/2014/09/bash-remote-vulnerability.html
http://support.apple.com/kb/HT1222
http://lists.gnu.org/archive/html/bug-bash/2014-09/msg00085.html
http://lists.gnu.org/archive/html/bug-bash/2014-09/msg00228.html
http://lists.gnu.org/archive/html/bug-bash/2014-09/msg00282.html

7/26/2012

Change Apple Mac OS X Software Update Service (SUS) address

Apple IU Software Update service allows uses to keep their Mac OS X machines updated with the latest software updates and security patched. In some controlled environments, the update servers are specified in the user profile. Sometimes there may be delays in the server updates, or problems with the local update server and users may desire to connect to Apple's services directly. Here's are some instructions that users may find useful. Please note that to make configuration changes you will need Administrative privileges on your Mac.

Users should also note that where a URL for the update catalog is not specified, network administrators may have implemented transparent update redirection by manipulating DNS entries on a local server for URLs such as; http://swscan.apple.com, http://swquery.apple.com, http://swdownload.apple.com, http://swcdn.apple.com

Check the SUS server settings
To check you current SUS settings, issue the following command from a terminal;

/usr/libexec/PlistBuddy -c Print /Library/Preferences/com.apple.SoftwareUpdate.plist
/usr/libexec/PlistBuddy -c Print ~/Library/Preferences/com.apple.SoftwareUpdate.plist

The above commands would produce an output similar to the following;

Dict {

LastAttemptSystemVersion = 10.7.2 (11C74)

LastRecommendedUpdatesAvailable = 0

RecommendedUpdates = Array {

}

CatalogURL = http://XXX.XXX.XXX.XX:8088/index.sucatalog

LastResultCode = 2

ScheduleFrequency = 1

LastUpdatesAvailable = 0

LastAttemptDate = Thu Jul 26 10:37:51 EST 2012

LastSuccessfulDate = Thu Jul 26 10:37:51 EST 2012

}

Change the SUS server settings back to Apple's default
Delete the CatalogURL entry by issuing the following command to force the IU software update to connect to Apple's URL

defaults delete /Library/Preferences/com.apple.SoftwareUpdate CatalogURL

To change the SUS server
To change the SUS server to any other value issue the following command from a terminal;

defaults write com.apple.SoftwareUpdate CatalogURL 'http://SERVER:PORT/index.sucatalog'

References

http://support.apple.com/kb/HT3923