Is Shellshock (bash) in FreeNAS or not?

[Bostjan]

FreeNAS team says that bash is not the system shell of FreeNAS or FreeBSD.
http://www.freenas.org/whats-new/2014/09/freenas-9-2-1-8-release-is-now-available.html


I didn't install bash and FreeNAS team says it is not part of FreeNAS. I'm concerned where did it come from.
When I try
env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
and I get
vulnerable
this is a test

I have a FreeNAS 9.2.1.7, just CIFS and SSH services are running and Owncloud 7.0.2 is installed. I have no additional packages installed or some other services running on FreeNAS.
FreeNAS in not facing internet; SSH, CIFS and Owncloud are only accessible on LAN.


I'm not concerned about security (yes, I’ll update FreeNAS) I would like to find out where did bash come from to my FreeNAS.


I know this question is weird, so please answer it seriously.


Thanks.

 

[anodos]

It is not a weird question, but it is one that has been answered in depth several times in these forums. You should search a bit harder next time. See post no 27 here: http://forums.freenas.org/index.php?threads/its-bashs-turn-to-have-a-security-hole.23698/page-2

Bash is included in FreeNAS by default. This is entailed by the statement in the 9.2.1.8 release notes stating

“Shellshock” security vulnerability in bash (which is not the system shell FreeNAS or FreeBSD) proactively closed.

If bash wasn't included then there would be nothing to close.

If you're worried about it upgrade to 9.2.1.8.

 

[Bostjan]

Thank you.

 

[jgreco]

FreeNAS team says that bash is not the system shell of FreeNAS or FreeBSD.
http://www.freenas.org/whats-new/2014/09/freenas-9-2-1-8-release-is-now-available.html

I didn't install bash and FreeNAS team says it is not part of FreeNAS. I'm concerned where did it come from.

To answer the question a little more precisely, you've misparsed what was said. "FreeNAS team says it is not part of FreeNAS" is false. What was said is that it isn't the system shell; it is a useless appendage included for the convenience of users who can't cope with a more traditional shell. It is not a significant issue because nothing included with the system calls it in a manner that would make the system vulnerable.