From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <zsh-users-return-19149-mason-zsh=primenet.com.au@zsh.org>
Received: (qmail 7439 invoked by alias); 25 Sep 2014 16:45:39 -0000
Mailing-List: contact zsh-users-help@zsh.org; run by ezmlm
Precedence: bulk
X-No-Archive: yes
List-Id: Zsh Users List <zsh-users.zsh.org>
List-Post: <mailto:zsh-users@zsh.org>
List-Help: <mailto:zsh-users-help@zsh.org>
X-Seq: 19149
Received: (qmail 23141 invoked from network); 25 Sep 2014 16:45:38 -0000
X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on f.primenet.com.au
X-Spam-Level: 
X-Spam-Status: No, score=-2.7 required=5.0 tests=BAYES_00,DKIM_SIGNED,
	DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FROM,RCVD_IN_DNSWL_LOW autolearn=ham
	version=3.3.2
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=gmail.com; s=20120113;
        h=mime-version:in-reply-to:references:from:date:message-id:subject:to
         :cc:content-type;
        bh=4qTbb9MFDuvroiKffs/rmbKxgOlMebeY0h0QK1ZK73U=;
        b=sbCw2+EpSpKLXWid/YFgY8j6egCIL/7kTzs402MufE9ffuZDVTBtdq8fWfMmjCG3cx
         LaMkuO/UxfWYC0RxasCV5bhgQ5xNV9ab08qA4k6F9ZPtlBS9WwnYbCt1UY5wF6littmq
         J4AwfYMoftaRUwn12kmTfYdFJj73TkzsCn+I2LW1Da51kOgltPvdggmYIADntLAokpkA
         ATEPDRNMOgC/zEV5x67R3wys77vLG8C94HvaH3nEPOi5VLTwyqyK3EkaIVxC3FtdSLWP
         yjkuV/JE9AcitpZ98TALBeghPxvMNc34snFJaokVVjOmn+uRD/R87z9PGie4g+y18OUT
         Rz0w==
X-Received: by 10.152.10.2 with SMTP id e2mr4239883lab.96.1411663533108; Thu,
 25 Sep 2014 09:45:33 -0700 (PDT)
MIME-Version: 1.0
In-Reply-To: <20140925174131.2575e3af@pwslap01u.europe.root.pri>
References: <1B204EC0-006C-47D9-80F3-007562954A8D@ucsc.edu> <20140925174131.2575e3af@pwslap01u.europe.root.pri>
From: shawn wilson <ag4ve.us@gmail.com>
Date: Thu, 25 Sep 2014 12:45:13 -0400
Message-ID: <CAH_OBifrcZ5UECeCEHqMLsx8csbrbTkE=BZDKUOxXUKXySbU4A@mail.gmail.com>
Subject: Re: Does the bash bug have a zsh counterpart?
To: Peter Stephenson <p.stephenson@samsung.com>
Cc: "William G. Scott" <wgscott@ucsc.edu>, Zsh Users <zsh-users@zsh.org>
Content-Type: text/plain; charset=UTF-8

On Thu, Sep 25, 2014 at 12:41 PM, Peter Stephenson
<p.stephenson@samsung.com> wrote:
> On Thu, 25 Sep 2014 09:35:01 -0700
> "William G. Scott" <wgscott@ucsc.edu> wrote:
>> Does any version of zsh have the same issue as bash, reported eg at
>>
>> <http://arstechnica.com/security/2014/09/bug-in-bash-shell-creates-big-security-hole-on-anything-with-nix-in-it/>
>
> No, search the zsh-workers archive at www.zsh.org for the last day or
> so.
>
>> I was thinking of temporarily replacing sh and bash on OS X with zsh
>> until a security fix is offered.
>
> If so, make sure you alias it to sh or otherwise cause it to come up in
> POSIX mode.
>
> Dash might be a better bet as it's more widely used for such things.
>

I wouldn't recommend dash as a solution - there might be other hidden
goodies there - see the recent vmware workstation suid issue caused by
dash thinking they were smarter.