From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <zsh-users-return-19147-mason-zsh=primenet.com.au@zsh.org>
Received: (qmail 18816 invoked by alias); 25 Sep 2014 16:41:38 -0000
Mailing-List: contact zsh-users-help@zsh.org; run by ezmlm
Precedence: bulk
X-No-Archive: yes
List-Id: Zsh Users List <zsh-users.zsh.org>
List-Post: <mailto:zsh-users@zsh.org>
List-Help: <mailto:zsh-users-help@zsh.org>
X-Seq: 19147
Received: (qmail 22135 invoked from network); 25 Sep 2014 16:41:36 -0000
X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on f.primenet.com.au
X-Spam-Level: 
X-Spam-Status: No, score=-6.9 required=5.0 tests=BAYES_00,RCVD_IN_DNSWL_HI,
	SPF_HELO_PASS autolearn=ham version=3.3.2
X-AuditID: cbfec7f4-b7f156d0000063c7-f4-542445bd31aa
Date: Thu, 25 Sep 2014 17:41:31 +0100
From: Peter Stephenson <p.stephenson@samsung.com>
To: "William G. Scott" <wgscott@ucsc.edu>, zsh-users@zsh.org
Subject: Re: Does the bash bug have a zsh counterpart?
Message-id: <20140925174131.2575e3af@pwslap01u.europe.root.pri>
In-reply-to: <1B204EC0-006C-47D9-80F3-007562954A8D@ucsc.edu>
References: <1B204EC0-006C-47D9-80F3-007562954A8D@ucsc.edu>
Organization: Samsung Cambridge Solution Centre
X-Mailer: Claws Mail 3.7.9 (GTK+ 2.22.0; i386-redhat-linux-gnu)
MIME-version: 1.0
Content-type: text/plain; charset=US-ASCII
Content-transfer-encoding: 7bit
X-Brightmail-Tracker:
 H4sIAAAAAAAAA+NgFprGLMWRmVeSWpSXmKPExsVy+t/xy7p7XVVCDLp3sVpMeP6M2WLHyZWM
	Dkwen7a3s3qsOviBKYApissmJTUnsyy1SN8ugSvj/sUvzAVfWSp+Ld7J1MD4i7mLkZNDQsBE
	YvHvY+wQtpjEhXvr2boYuTiEBJYySkycd5wdwulnkji06zBYFYuAqsS9B6fAbDYBQ4mpm2Yz
	gtgiAjYS/441soDYwgJmEnMf/QDbwCtgL/Hy2hawOCdQzckz64FsDqCh1hIfzoeAhPkF9CWu
	/v3EBHGEvcTMK2cYIVoFJX5MvgfWyiygJbF5WxMrhC0vsXnNW+YJjAKzkJTNQlI2C0nZAkbm
	VYyiqaXJBcVJ6bmGesWJucWleel6yfm5mxghYfllB+PiY1aHGAU4GJV4eD38lUOEWBPLiitz
	DzFKcDArifBy6KuECPGmJFZWpRblxxeV5qQWH2Jk4uCUamCsPj55/QPpctn4xn2fGbSuzUw6
	NXNd4gmP/+vv2UlP447/YrpvF+ct8Y4VxhcEDf5GZ/nt6txc5Lx91dEr+3TXhr27uW35/OY6
	0W9xub5TlXiWP5auUDsh6NNicmhl1sWnGWciA3ZaBrW8q2Eo+R52efv7Jam/y+tf6u/K277g
	j71sz7qA6ox+JZbijERDLeai4kQACf1JhSkCAAA=

On Thu, 25 Sep 2014 09:35:01 -0700
"William G. Scott" <wgscott@ucsc.edu> wrote:
> Does any version of zsh have the same issue as bash, reported eg at
> 
> <http://arstechnica.com/security/2014/09/bug-in-bash-shell-creates-big-security-hole-on-anything-with-nix-in-it/>

No, search the zsh-workers archive at www.zsh.org for the last day or
so.

> I was thinking of temporarily replacing sh and bash on OS X with zsh
> until a security fix is offered.

If so, make sure you alias it to sh or otherwise cause it to come up in
POSIX mode.

Dash might be a better bet as it's more widely used for such things.

pws