Inside Shellshock: How hackers are using it to exploit systems

Re:Inside Shellshock: How hackers are using it to exploit sy... by meowface on Tuesday September 30, 2014 @11:59PM (#8392738)

This is not actually a big problem for 99.9% of web apps out there. Only CGI web apps actually need to be concerned. Anything else is pretty much sensationalism.

It absolutely is a problem for many other things, but non-CGI web apps is almost always not one of them.

[ Parent | on HN ]

Re:Inside Shellshock: How hackers are using it to exploit sy... by brians on Wednesday October 01, 2014 @12:45AM (#8392877)

Some FastCGI frameworks helpfully set up environment variables in the web app---you know, just in case you run a sub-process and want it to work the same way it would have from a CGI.

See Per-Request Environment Variables at http://www.fastcgi.com/devkit/doc/fastcgi-prog-guide/ch1intr...

These aren't ubiquitous---but it also isn't just CGI programs that expose this vulnerability.

[ Parent | on HN ]