[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20140924190321.2d43a072@pc>
Date: Wed, 24 Sep 2014 19:03:21 +0200
From: Hanno Böck <hanno@...eck.de>
To: oss-security@...ts.openwall.com
Subject: Re: CVE-2014-6271: remote code execution through
bash
On Wed, 24 Sep 2014 18:30:35 +0200
Florian Weimer <fweimer@...hat.com> wrote:
> This depends on how PHP is invoked. mod_php does not set the CGI
> environment variables.
>
> However, it is true that if CGI programs spawn subprocesses, they may
> be affected even if the CGI program itself is not written in bash.
Regarding php, isn't it quite common to run it through mod_fcgid with a
(bash) wrapper script? At least that's what apache wiki documents:
https://wiki.apache.org/httpd/php-fcgid
So that'd mean many php installations are affected even if they don't
use subprocesses.
I'm not sure if this wrapper can be avoided.
--
Hanno Böck
http://hboeck.de/
mail/jabber: hanno@...eck.de
GPG: BBB51E42
Download attachment "signature.asc" of type "application/pgp-signature" (820 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
