Does the Shellshock Bash bug affect ZSH?

Is upgrading Bash the only solution?

  • according to this answer on a different exchange, ZSH does not export functions. Since the Shellshock bug was caused by this bash specific feature, other shells that lack it should probably not be affected.
    – lzam
    Sep 29 '14 at 2:27

No, it doesn't affect ZSH.

You still MUST update bash as most of the system scripts are written for bash and vulnerable to the shellshock bug.

To test your ZSH do this:

env x='() { :;}; echo vulnerable' zsh -c 'echo hello'

What exactly does this code do?

  1. env x='() { :;}; echo vulnerable' creates an environment variable with known bug using command in the end of variable
  2. zsh -c 'echo hello' launches ZSH shell with simple hello (and evaluating all env variables including x)

If you see output:


Then your ZSH is vulnerable. Mine (5.0.2) is not:

$ env x='() { :;}; echo vulnerable' zsh -c 'echo hello'
  • 1
    if we use zsh but still we have bash in our system! do we need to worry about that? if not why? Sep 26 '14 at 5:21
  • 16
    @Dineshkumar: yes, you should still worry & patch. The reason is that even if you are using zsh, other programs (dhcp was mentioned, many PHP applications will probably do, and lots of other programs and scripts on a typical Linux machine) will still call bash. (In fact, they shouldn't, but it has become a bad habit.)
    – hans_meine
    Sep 26 '14 at 8:16
  • 2
    @stephenmurdoch Ubuntu 10.10 is quite old and hasn't been supported for over 2 years...
    – Izkata
    Sep 26 '14 at 13:55
  • 2
    @Ghanima: calling bash is a bad habit for system utilities because bash is not guaranteed to be installed; /bin/sh is the standard shell and is required to be a correct POSIX shell interpreter.
    – Phil Hord
    Sep 26 '14 at 14:40
  • 2
    fwiw - When bash is run as /bin/sh, it runs as a POSIX-compatible shell. In this mode, however, it also has the bug. env x='() { :;}; echo vulnerable' sh -c 'echo hello'
    – Phil Hord
    Sep 26 '14 at 15:04

From this link:

You can determine if you are vulnerable to the original problem in CVE-2014-6271 by executing this test:

env x='() { :;}; echo vulnerable' bash -c 'echo hello'

If you see the word vulnerable in the output of that command your bash is vulnerable and you should update. Below is a vulnerable version from OS X 10.8.5:

env x='() { :;}; echo vulnerable' bash -c 'echo hello'

The following output is an example of a non-vulnerable bash version.

$ env x='() { :;}; echo vulnerable' bash -c 'echo hello'
bash: warning: x: ignoring function definition attempt
bash: error importing function definition for `x'
  • Also note that when patching bash following the instructions on the link zshell stopped being vulnerable, which makes me think that zshell uses bash at its core.
    – vectorsize
    Sep 25 '14 at 12:55
  • 9
    Note that there has been a followup: env X='() { (a)=>\' bash -c "echo date" will, on a patched bash and despite throwing lots of errors, produce a file called echo which contains the date. I don’t want to know why. Sep 25 '14 at 13:06
  • @Jonas Wait, produce a file?! I understand the vulnerability, but that's just bizarre.
    – Doorknob
    Sep 25 '14 at 17:08
  • 5
    @vectorsize zsh does not use bash at its core. bash is explicitly called in your examples. It does not matter which shell you are using to run these lines. This vulnerability affects the newly started bash shell, not the shell it is run from.
    – Adaephon
    Sep 25 '14 at 20:44
  • 2
    @Adaephon So one would like to replace bash in the examples by $SHELL. Sep 25 '14 at 21:07

The binary is not affected

It does not affect zsh as the shell executable, because it's source code never contained the error.
There are many similaritys between bash and zsh, but they werer implemented independent from each other. The same feature is implemented in two different ways, and - more important in this context - usually with different errors.

But the interactive use is

Indirectly it does affect working interactively with the zsh shell in a terminal almost as much as working with bash.

The use of bash is just so common that one can hardly avoid to call it.

Too many uses to avoid

  • scripts you know and expect to use zsh, but actually contain bash.
  • lots of shell scripts that use #!/bin/bash to specify bash as the interpreter.
  • lots of commands that you assume are binaries, but are shell scripts, some of them using bash.

  • in many places where a shell is executed explicitly, bash may be used, and possibly required.

    • like complex xargs commands, or git aliases involving arguments
    • default shells of terminal emulators
    • shell of users you sudo to
    • etc.

No, Shellshock does not affect zsh directly.

However many environments that use zsh as the default shell also have bash installed. Any shell, including zsh, can be used to spawn a compromised bash shell:

zsh ❯ env X='() { (a)=>\' sh -c "echo date"; cat echo
sh: X: line 1: syntax error near unexpected token `='
sh: X: line 1: `'
sh: error importing function definition for `X'
Fri 26 Sep 2014 12:05:57 BST

To defend against this you should patch, uninstall or disable any redundant versions of bash. You could disable the system bash install with chmod:

$ chmod a-x /bin/bash

However, it is common for scripts to explicitly call bash. Scripts that do this, and those that use bash-specific scripting features, will fail if bash is not available. Patching is the best solution.

  • it seems that zsh implicitly use bash for "importing function definition" ? I also tested with ssh-server injection: ssh testuser@localhost '() { :;}; echo "$SHELL"' where I set the testuser's login shell to /bin/zsh, and it echoes /bin/zsh
    – Bossliaw
    Sep 28 '14 at 18:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.