2 ms·

So if a machine is not running a web server, does that mean that machine is not vulnerable?

• ars 12y ago
  No. Apparently ssh might be vulnerable.
• scott_karana 12y ago
  It might not be vulnerable, but any context where a user can pass environment variables might be dangerous. Eg, if you allow ANY environment variables in SSH rsync-only logins, or pass on any variables (for good or bad) in sudo scripts, etc.
• MichaelGG 12y ago
  No, all sorts of other network-facing systems can be vulnerable. Anything that ends up shelling out might pass some environment variables causing the problem. These things pop up in surprising places.