4 ms·

If PassengerLoadShellEnvvars is set to 'no' or the login shell is not bash (or sh) would this analysis apply? The documentation and code seem to say that bash

• FooBarWidget 12y ago
  Indeed. When PassengerLoadShellEnvvars is turned off, or if bash is not the user's configured shell, it will not invoke bash. Regarding the Debian 7 patch: I can't find the link, but they released bash package 4.2+dfsg-0.1+deb7u3 shortly before we published the advisory. The changelog explicitly mentions CVE-2014-7169. I also tested the exploit code, and wasn't able to trigger the exploit on their new bash.
  • swelmer 12y ago
    It looks like something happened overnight last night and the patch became visible after I posted. You may want to update the docs to include zsh and ksh as shells that you will use since shouldLoadShellEnvvars checks for all three. I found a place where back ticks are used to get something done: file lib/phusion_passenger/platform_info/apache.rb, method httpd_infer_envvar. If Passenger somehow gets a corrupted environment and calls httpd_infer_envvar then it would trip over Shellshock on an unpatched system. I didn't search generally for back ticks or other shell entry points, but you may want to remove extraneous shell invocations as a future proofing step against other vulnerabilities showing up in shells. (I know, you said that was insane, but so was all of yesterday :)
    • FooBarWidget 12y ago
      httpd_infer_envvar is never called from HTTP requests. It's only used by administrative command line tools.