Re: [nznog] Shell Shock - Bash vulnerability - CVE-2014-6271

On Sun, Sep 28, 2014 at 1:11 AM, Eliezer Croitoru wrote:

Squid discourage the usage of bash helpers in general but there are couple nice codes which helps with that.

You're missing the point. Completely. This isn't about "bash helpers". It's about the system() function call. If one C program runs another C program, and if it does it via the system() function call (a standard C function since, well, pretty much forever), then it does it by calling bash. You can replace "C program" with basically anything else in that sentence, and the result is the same. To quote the system(3) man page : *SYNOPSIS* * #include * * int system(const char *command);* *DESCRIPTION* * system() executes a command specified in command by calling /bin/sh -c* * command, and returns after the command has been completed.* Under most Linux (not including embedded/etc Linux), /bin/sh is Bash. It doesn't matter if your application never deliberately uses bash, there's still a very good chance it actually, well, uses bash. You can make as many excuses as you want, but you're wrong. Scott