Re:Another ShellShock exploit in the wild
by danielweber on Thursday September 25, 2014 @12:25PM
(#8367986)
All the modern webserver<->framework interfaces don't call bash directly, but they may end up calling it indirectly in one of a dozen different ways.
[ Parent
| on HN ]
Re:Another ShellShock exploit in the wild
by tlrobinson on Thursday September 25, 2014 @12:56PM
(#8368175)
And environment variables are typically inherited by subprocesses, so if the CGI script executes anything (that executes anything, recursively) that uses bash (including system() if /bin/sh is bash, e.x. on OS X) this bug becomes exploitable?