> However the fact that the script isn't setuid isn't really > the concern for these shellshock, since a setuid program > could indirectly run /bin/sh. A setui

> However the fact that the script isn't setuid isn't really > the concern for these shellshock, since a setuid program > could indirectly run /bin/sh. A setuid program which runs any child process without having first cleared the environment or authenticated the caller for root access is already broken by means of LD_PRELOAD.