BLU Discuss list archive
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Discuss] Shellshock
- Subject: [Discuss] Shellshock
- From: invalid at pizzashack.org (Derek Martin)
- Date: Wed, 1 Oct 2014 22:00:54 -0500
- In-reply-to: <CAAbKA3WyRgGpEbsX3A3_X75g=FB41Hp8Yx7f-CoEUPCTwVaOjw@mail.gmail.com>
- References: <542B5DFA.2080108@gmail.com> <542B5F49.3050500@gmail.com> <CAAbKA3U4r-rxkAW33HPfv6FJE36rqDJx6qESbrS4r7G_VBN1Mw@mail.gmail.com> <542C6B15.4080507@gmail.com> <CAAbKA3WyRgGpEbsX3A3_X75g=FB41Hp8Yx7f-CoEUPCTwVaOjw@mail.gmail.com>
On Wed, Oct 01, 2014 at 05:33:58PM -0400, Bill Ricker wrote: > On Wed, Oct 1, 2014 at 4:59 PM, Tom Metro <tmetro+blu at gmail.com> wrote: > > But in the case of CGI you are just moving the network/local > > barrier a bit further down the stack. > > and moved it right through system() => /bin/sh => /bin/bash by alias > which last wasn't designed to be network secure. Of course, anyone who's writing CGI scripts and using system() should be fired. This has been well-known as a very serious security hole for oh, just about as long as the CGI interface has existed, so anyone still doing this now is either lazy to the point of malice or just not qualified to do the job. -- Derek D. Martin http://www.pizzashack.org/ GPG Key ID: 0xDFBEAD02 -=-=-=-=- This message is posted from an invalid address. Replying to it will result in undeliverable mail due to spam prevention. Sorry for the inconvenience.
- References:
- [Discuss] Shellshock
- From: tmetro+blu at gmail.com (Tom Metro)
- [Discuss] Shellshock
- From: bill.n1vux at gmail.com (Bill Ricker)
- [Discuss] Shellshock
- Prev by Date: [Discuss] CipherShed: TrueCrypt fork
- Next by Date: [Discuss] vz outgoing mail
- Previous by thread: [Discuss] Shellshock
- Next by thread: [Discuss] Shellshock
- Index(es):