4 ms·
It is hilarious that you claim this is not remotely exploitable in response to a post describing how a very simple and limited scan has already found thousands
by clarry 12y ago
It is hilarious that you claim this is not remotely exploitable in response to a post describing how a very simple and limited scan has already found thousands of vulnerable hosts in a short timeframe.
And I dare say there are lots of admins who do not know exactly what their servers are going to execute because they're using software written by other people. That's why we call them admins, not software developers.
By the way, system() can be used in quite a lot of languages, not just in plain C.
And there are definitely more attack vectors than CGI. CGI is just the most obvious one.
- f00ber 12y agoWell, let these _admins_ worry about this. This is of no concern for the moment for a regular Linux or OS X user. Now, an admin _must_ know every service running on entrusted boxes facing the Internet. CGI scripts hopefully are not common these days. If you run them do stop for other reasons. So far every "attack vector" implies having shell access to the target machine in some form. No need to panic for majority of people.
- ccvannorman 12y agoCan you clarify this? As a Mac OS X user who connects to public wifi often, I'm still in the dark about whether I should literally turn off my wifi for now..
- f00ber 12y agoI don't think DHCP in Mac OS X is affected. I am yet to see a proof that any Linux client is affected either. I am pretty sure that a few dozen servers that happily serve Web content within my reach are not affected either. If idiots could stop spreading panic and clearly state the conditions and risks, we'd all be served better.
- eropple 12y agoOr, you know, running Rails with Passenger.