4 ms·

AFAIK Apache itself isn't vulnerable, because it probably doesn't invoke a shell. CGI apps it invokes might, which is how the vulnerability is triggered.

masklinn 12y ago
> because it probably doesn't invoke a shell Some people write cgi in bash. Yeah.
- scintill76 12y ago
  Yeah, I meant Apache itself doesn't invoke a shell.
nailer 12y ago
My understanding is that Apache starts CGI apps in environments with variables for things like HTTP_USER_AGENT that are set by random people on the internet through Apache.
- vidarh 12y ago
  Yes, because that is what the CGI spec demands. There is nothing inherently insecure in that: The environment is just a bunch of strings. Whether or not it is insecure depends 100% on the CGI that gets executed. Which programs that is 100% down to the person configuring the website. Apache does not even have a theoretical way to ensure those applications does not do anything stupid with the data no matter the method used to pass it. You have the simple solution if you are concerned about environment variable passing of not trusting mod_cgi. Most people have not used it for years anyway, because of the performance impact.
  - nailer 12y ago
    Yes, the CGI spec is obviously broken. Clearing a environment ala Postfix or using a socket would have been the obvious fix in the 90s.
RubyPinch 12y ago
I think it depends on the situation, at least that is what I've gleaned from my reading of it if you run a .php file and you have mod_php or the webserver has understanding of the concept of PHP and calls the binary directly, all nice and good if you have a something.randomext or something without an extension at all, then... whelp luckily there is a program that is dedicated to working out how to run random executable files, the shell (and it uses the shell-bang, or shbang for short), so in that situation, the call will be done though the shell

masklinn 12y ago

> because it probably doesn't invoke a shell Some people write cgi in bash. Yeah.

scintill76 12y ago
Yeah, I meant Apache itself doesn't invoke a shell.

nailer 12y ago

My understanding is that Apache starts CGI apps in environments with variables for things like HTTP_USER_AGENT that are set by random people on the internet through Apache.

vidarh 12y ago
Yes, because that is what the CGI spec demands. There is nothing inherently insecure in that: The environment is just a bunch of strings. Whether or not it is insecure depends 100% on the CGI that gets executed. Which programs that is 100% down to the person configuring the website. Apache does not even have a theoretical way to ensure those applications does not do anything stupid with the data no matter the method used to pass it. You have the simple solution if you are concerned about environment variable passing of not trusting mod_cgi. Most people have not used it for years anyway, because of the performance impact.
- nailer 12y ago
  Yes, the CGI spec is obviously broken. Clearing a environment ala Postfix or using a socket would have been the obvious fix in the 90s.

RubyPinch 12y ago

I think it depends on the situation, at least that is what I've gleaned from my reading of it if you run a .php file and you have mod_php or the webserver has understanding of the concept of PHP and calls the binary directly, all nice and good if you have a something.randomext or something without an extension at all, then... whelp luckily there is a program that is dedicated to working out how to run random executable files, the shell (and it uses the shell-bang, or shbang for short), so in that situation, the call will be done though the shell