Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Fri, 10 Oct 2014 07:51:11 +1100 (EST)
From: Dave Horsfall <>
To: OSS Security <>
Subject: Of Shellshock and logfiles

I don't *think* I've seen this mentioned here (and apologies if so), but 
somebody posited on another list that Shellshock attempts in one's Apache 
logs are not directed against PHP or its scripts, but rather against those 
Bash scripts that analyse the Apache logs in turn...  I've heard of 
similar things in mail logs, which *could* be the result of attempting to 
target either Procmail or logfile analysers.

Then again, maybe the spammers really are that desperate that they'll try 
anything that they think might work.

-- Dave

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.