4 ms·
The article points you you can run the following code to check you are affected: env X="() { :;} ; echo busted" /bin/sh -c "echo stuff" However... This ju
by TeeWEE 12y ago
The article points you you can run the following code to check you are affected:
env X="() { :;} ; echo busted" /bin/sh -c "echo stuff"
However... This just shows that the bash installation has this problem. If your webserver that is running is not interacting with bash, then there is no problem at all.
So look at your webserver. Its not per-se a problem in bash. Its more a problem of webservers using bash directly.
Or is this bug more serious?
- RickHull 12y agoThere are many network daemons besides httpd which, if they delegate request handling to any other process or system functionality, may: 1. Invoke bash somewhere in the call stack 2. Pass request data via environment variables If both of these are true, then the daemon is presumed vulnerable. You may still be vulnerable if (2) is false (by design) yet the attacker is able to set environment variables. CGI / Apache / httpd is the obvious vector, but don't be lured into complacency.
- boynamedsue 12y agoA webserver doesn't have to interact with bash directly or otherwise for a system to be vulnerable to this bug. Here's one scenario: 1. A webserver may set environment variables passed to it from a URL perhaps. 2. Malicious users could craft a URL that set environment variables containing bash commands that do nefarious things. 3. The next time bash is launched (either by a human or programmatically) those nefarious commands are executed perhaps with root privileges.