4 ms·
> Apache should have used a socket rather than the shell (which effectively evaluates data as instructions). But the shell shouldn't evaluate data as instructi
by clarry 12y ago
> Apache should have used a socket rather than the shell (which effectively evaluates data as instructions).
But the shell shouldn't evaluate data as instructions. This is the bug!
Apache could have used a socket and I could write a buggy endpoint which evaluates data read from that socket as instructions. Tada, same problem, same bug.
- nailer 12y agoAll Unix shells don't really separate data from instructions. Your PS1, for example, can contain commands in backticks and subshells, it's expected to be able to do so. Shells are insecure. You could replace them with something compatible but insecure, but they wouldn't be a POSIX shell anymore. Hence the well known SetUID blocking on shell scripts, hence not letting random people on the internet set shell variables.
- clarry 12y agoWell, it's well known that being able to freely set certain environment variables is a disaster. That any variable regardless of its name should have such an effect is, however, news. You can talk all you want about unrelated gotchas in shells & security, and that's missing the point.