There are many network daemons besides httpd which, if they delegate request handling to any other process or system functionality, may: 1. Invoke bash som

There are many network daemons besides httpd which, if they delegate request handling to any other process or system functionality, may: 1. Invoke bash somewhere in the call stack 2. Pass request data via environment variables If both of these are true, then the daemon is presumed vulnerable. You may still be vulnerable if (2) is false (by design) yet the attacker is able to set environment variables. CGI / Apache / httpd is the obvious vector, but don't be lured into complacency.