Apple says most customers not vulnerable to 'shellshock,' patch coming for advanced users

"The vast majority of OS X users are not at risk to recently reported bash vulnerabilities," an Apple spokesperson said in a statement to iMore. "With OS X, systems are safe by default and not exposed to remote exploits of bash unless users configure advanced UNIX services," the spokesperson added, before noting that Apple is "working to quickly provide a software update for our advanced UNIX users."

The bug, nicknamed "shellshock" by members of the computer security community, is thought to be present in every version of bash since its introduction in 1989. By passing specially-crafted commands to computers running vulnerable releases of bash, an attacker could — without authentication —  remotely execute arbitrary commands that could modify systems or exfiltrate data.

Because bash is present on nearly every Linux and UNIX system that has shipped in last 20 years, the potential for damage is immense if machines are not quickly patched. Fortunately for most OS X users, their computers are rarely directly exposed to the internet, and even more rarely are they configured to expose potentially vulnerable endpoints — like HTTP servers —  to the network.

Advanced users who have OS X machines in a situation where they may be remotely exploited, such as systems administrators with internet-facing OS X servers, can mitigate the issue by recompiling bash with the official patches from GNU until Apple issues its own update.