3 ms·

I'm confused by this vuln report and all the attention. If I don't run any CGI thing and I don't expose SSH without pubkey and only to trusted users, what is t

• teraflop 12y ago
  The CGI and SSH attack vectors are getting a lot of attention because they are so trivially exploitable. But as someone (I believe tptacek) put it in another thread, this bug has one of the biggest potential attack surfaces in history. Anything that sets any environment variable to an untrusted value and then invokes bash is vulnerable. For example, on some systems, simply connecting to an attacker-controlled network is enough to cause code execution through the DHCP client. If you choose not to upgrade bash, you are trusting that none of the code on your system uses bash in this way. It's extremely unlikely that the vectors that have been publicized so far are the only major ones.
  • AYBABTME 12y ago
    Alright so necessary conditions are "sets env variables" + "invoke bash". That clarifies, thanks. I'm not advocating not updating, I'm just trying to understand what to do with this info for say, my hosted project that _doesn't set env vars nor invoke bash_.
• smackfu 12y ago
  Does your firewall run Linux? What technologies are used to implement its logon page? That's the kind of thing people are worried about.