4 ms·
118.192.48.6 - - [28/Sep/2014:20:30:22 +0000] "GET /cgi-bin/authLogin.cgi HTTP/1.1" 404 767 "http://www.baidu.com" http://www.baidu.com" "() { :; }; echo X-Bash
by smtddr 12y ago
118.192.48.6 - - [28/Sep/2014:20:30:22 +0000] "GET /cgi-bin/authLogin.cgi HTTP/1.1" 404 767 "http://www.baidu.com" http://www.baidu.com" "() { :; }; echo X-Bash-Test: `echo iOGFtdnW7o`;"
My app runs on bottlepy.org, so I assume I'm not at risk? I don't do any popen() stuff.
- barosl 12y agoEven if you use popen() or system() in your application, Debian/Ubuntu machines are not affected. These distributions don't use bash for /bin/sh. `dash`(Debian ash) is used instead. Good work, Debian!
- m4r71n 12y agoDepends on which Debian version you're running: "Up to DebianLenny, the default /bin/sh shell was bash. Starting with DebianSqueeze, the default shell will be dash (see DashAsBinSh)." [https://wiki.debian.org/Shell https://wiki.debian.org/Shell] I think the safest thing here is to update no matter what shell your system is using. There is a multitude of vectors on how to attack a vulnerable machine if it has Bash installed on it.
- nitrogen 12y agoDebian has lots of Bash scripts in /usr/bin. Make sure you aren't indirectly using any of them. Or just patch Bash.
- xorcist 12y agoYeah, that's an important point to stress: Whether you have been vulnerable to this bug or not is important -- for the decision to wipe and reinstall. It's not important for the decision to patch, which should be done everywhere possible.