4 ms·

This of course assumes that bash is set as the default shell for those users all those programs run under. None of my systems have bash installed, thus they are

• sophacles 12y ago
  All those osx machines have bash as /bin/sh by default too. It's unclear how often shellouts happen within OSX for various operations.
• nitrogen 12y ago
  Any program that calls a library that calls a program that executes a script with #!/bin/bash could be vulnerable, client or server. There are many ways data can get into an environment variable. For example, a hypothetical encryption library might be a wrapper around /usr/bin/gpg or /usr/bin/openssl, and to avoid having arguments show up in ps or top, it might pass arguments as environment variables. Later a secure e-mail program might use that library to validate a signature from an e-mail, and pass signature data in an environment variable. So that's MacOSX and Fedora owned with /bin/bash as /bin/sh. Say the encryption library used a script written in Bash to do some other processing. That's BSD owned.
  • X-Istence 12y ago
    Except that bash is not installed by default... if bash is not installed how does BSD suddenly become vulnerable?
    • nitrogen 12y ago
      It would have been installed as a dependency of whatever used it in some obscure way.
      • nitrogen 12y ago
        Okay, since someone actually downvoted both of my comments, I'll point out that libgpgme is a common encryption library that calls /usr/bin/gpg. Fortunately it uses execv(), but that leaves the environment unchanged so if anything further down the chain uses Bash it's still vulnerable. I'll also provide a list of files from /usr/bin that are actually implemented using Bash (from a Linux Mint system). Anything using these with user-controlled environment variable values is vulnerable: $ grep -nR '#!.*bash' * | grep :1: apg:1:#!/bin/bash aptitude-create-state-bundle:1:#!/bin/bash aptitude-run-state-bundle:1:#!/bin/bash banshee:1:#!/usr/bin/env bash cautious-launcher:1:#!/bin/bash checkinstall:1:#!/bin/bash cinnamon2d:1:#!/bin/bash dns-fix:1:#!/bin/bash editdiff:1:#!/bin/bash fakenect:1:#!/bin/bash fakeroot:1:#!/bin/bash fakeroot-sysv:1:#!/bin/bash fakeroot-tcp:1:#!/bin/bash gnome-www-browser:1:#!/bin/bash google-chrome:1:#!/bin/bash google-chrome-stable:1:#!/bin/bash gufw-pkexec:1:#!/bin/bash im-config:1:#!/bin/bash -e init-checkconf:1:#!/bin/bash installwatch:1:#!/bin/bash inxi:1:#!/bin/bash itweb-settings:1:#!/bin/bash javaws:1:#!/bin/bash lcf:1:#!/bin/bash ldd:1:#! /bin/bash libtool:1:#! /bin/bash lua2dox_filter:1:#!/bin/bash lzcmp:1:#!/bin/bash lzdiff:1:#!/bin/bash lzegrep:1:#!/bin/bash lzfgrep:1:#!/bin/bash lzgrep:1:#!/bin/bash lzless:1:#!/bin/bash lzmore:1:#!/bin/bash mate-help:1:#!/bin/bash mintBackup:1:#!/bin/bash mint-fortune:1:#!/bin/bash mintupload:1:#!/bin/bash mintupload-manager:1:#!/bin/bash muinshee:1:#!/usr/bin/env bash mysqld_safe:1:#!/bin/bash p7zip:1:#!/bin/bash pipelight-plugin:1:#!/usr/bin/env bash pnmindex:1:#!/bin/bash policyeditor:1:#!/bin/bash ppmquantall:1:#!/bin/bash rarian-sk-config:1:#!/bin/bash rarian-sk-extract:1:#!/bin/bash rarian-sk-rebuild:1:#!/bin/bash rarian-sk-update:1:#!/bin/bash scrollkeeper-config:1:#!/bin/bash scrollkeeper-extract:1:#!/bin/bash scrollkeeper-rebuilddb:1:#!/bin/bash scrollkeeper-update:1:#!/bin/bash sotruss:1:#! /bin/bash steam:1:#!/usr/bin/env bash su-to-root:1:#!/bin/bash tomboy:1:#!/usr/bin/env bash tzselect:1:#!/bin/bash ucf:1:#!/bin/bash ucfr:1:#! /bin/bash usb-devices:1:#!/bin/bash X11/scrollkeeper-config:1:#!/bin/bash X11/fakenect:1:#!/bin/bash X11/lzgrep:1:#!/bin/bash X11/cautious-launcher:1:#!/bin/bash X11/xzdiff:1:#!/bin/bash X11/aptitude-create-state-bundle:1:#!/bin/bash X11/mint-fortune:1:#!/bin/bash X11/mate-help:1:#!/bin/bash X11/scrollkeeper-extract:1:#!/bin/bash X11/fakeroot:1:#!/bin/bash X11/editdiff:1:#!/bin/bash X11/lzdiff:1:#!/bin/bash X11/apg:1:#!/bin/bash X11/mintupload-manager:1:#!/bin/bash X11/gnome-www-browser:1:#!/bin/bash X11/ucfr:1:#! /bin/bash X11/lzcmp:1:#!/bin/bash X11/libtool:1:#! /bin/bash X11/im-config:1:#!/bin/bash -e X11/xzmore:1:#!/bin/bash X11/mintupload:1:#!/bin/bash X11/xzegrep:1:#!/bin/bash X11/javaws:1:#!/bin/bash X11/xchat-systray:1:#!/bin/bash X11/itweb-settings:1:#!/bin/bash X11/dns-fix:1:#!/bin/bash X11/su-to-root:1:#!/bin/bash X11/checkinstall:1:#!/bin/bash X11/usb-devices:1:#!/bin/bash X11/rarian-sk-extract:1:#!/bin/bash X11/tzselect:1:#!/bin/bash X11/google-chrome-stable:1:#!/bin/bash X11/xzcmp:1:#!/bin/bash X11/xzgrep:1:#!/bin/bash X11/pipelight-plugin:1:#!/usr/bin/env bash X11/lcf:1:#!/bin/bash X11/scrollkeeper-rebuilddb:1:#!/bin/bash X11/banshee:1:#!/usr/bin/env bash X11/cinnamon2d:1:#!/bin/bash X11/xzfgrep:1:#!/bin/bash X11/muinshee:1:#!/usr/bin/env bash X11/lzfgrep:1:#!/bin/bash X11/mintBackup:1:#!/bin/bash X11/tomboy:1:#!/usr/bin/env bash X11/fakeroot-sysv:1:#!/bin/bash X11/aptitude-run-state-bundle:1:#!/bin/bash X11/gufw-pkexec:1:#!/bin/bash X11/init-checkconf:1:#!/bin/bash X11/x-www-browser:1:#!/bin/bash X11/lzegrep:1:#!/bin/bash X11/rarian-sk-update:1:#!/bin/bash X11/sotruss:1:#! /bin/bash X11/ldd:1:#! /bin/bash X11/ppmquantall:1:#!/bin/bash X11/rarian-sk-rebuild:1:#!/bin/bash X11/xzless:1:#!/bin/bash X11/rarian-sk-config:1:#!/bin/bash X11/p7zip:1:#!/bin/bash X11/google-chrome:1:#!/bin/bash X11/lzmore:1:#!/bin/bash X11/fakeroot-tcp:1:#!/bin/bash X11/mysqld_safe:1:#!/bin/bash X11/ucf:1:#!/bin/bash X11/policyeditor:1:#!/bin/bash X11/lzless:1:#!/bin/bash X11/lua2dox_filter:1:#!/bin/bash X11/installwatch:1:#!/bin/bash X11/inxi:1:#!/bin/bash X11/scrollkeeper-update:1:#!/bin/bash X11/steam:1:#!/usr/bin/env bash X11/pnmindex:1:#!/bin/bash xchat-systray:1:#!/bin/bash x-www-browser:1:#!/bin/bash xzcmp:1:#!/bin/bash xzdiff:1:#!/bin/bash xzegrep:1:#!/bin/bash xzfgrep:1:#!/bin/bash xzgrep:1:#!/bin/bash xzless:1:#!/bin/bash xzmore:1:#!/bin/bash
    • jameshart 12y ago
      This is as helpful as a windows admin saying 'this whole thing seems to be blown out of proportion, none of my servers are vulnerable'.