Linux bash vulnerability

[suityou01]

The idea that this is trivial. Its massive

Well we are the only ones on CUK.

[Stevie Wonder Boy]

Must all be penpushing testers

[stek]

Only affects people who can't use vi on the command line!

We've removed it from proper Unixes where some bell end has installed it, only pretend unix fanbois seem to depend on it so we've had to pander to them for this 20 year old exploit...

[suityou01]

I'm getting that Stek is old, and set in his ways.

[Stevie Wonder Boy]

uh no .. hell no bash is the default shell. So everytime apache spawns a process it starts a bash shell. On an unpatched system you can use header variables to run anything you like on the target box.

Your vi supposition is clearly wrong and shows a pretty simple understanding of current linux os and processes.

[TykeMerc]

I'm getting that Stek is old, and set in his ways.

That's ok, we got that you're a hysterical, fantasist, brainless ****wit twat years ago, you just reinforce the view on a regular basis.

Sure it's serious, but is it end of the world stuff? Nope.
Are the vendors unable to cope with it? Nope.
Are fixes being rolled out at a decent pace? Yep.

Are some contractors with the relevant skills making money from what's happened? Yup

[suityou01]

The attack vector of choice is NAS boxes bizarrely. But I don't think the full hand has been played yet. Sensibly biding their time rather than peaking too soon.

[suityou01]

That's ok, we got that you're a hysterical, fantasist, brainless ****wit twat years ago, you just reinforce the view on a regular basis.

Sure it's serious, but is it end of the world stuff? Nope.
Are the vendors unable to cope with it? Nope.
Are fixes being rolled out at a decent pace? Yep.

Are some contractors with the relevant skills making money from what's happened? Yup

I like your world. It's like Disney Pixar in there isn't it?

[CheeseSlice]

The attack vector of choice is NAS boxes bizarrely. But I don't think the full hand has been played yet. Sensibly biding their time rather than peaking too soon.

Looking back all those years to SQL slammer again. The windows security patch was actually released 6 months before the attack was unleashed causing widespread damage and disruption to businesses. The problem is so many organisations are still tulip at rolling out patches it wouldn't surprise me if something like this could happen again.

[stek]

uh no .. hell no bash is the default shell. So everytime apache spawns a process it starts a bash shell. On an unpatched system you can use header variables to run anything you like on the target box.

Your vi supposition is clearly wrong and shows a pretty simple understanding of current linux os and processes.

On Linux maybe so. Linux isn't even Unix...

It might be a shock to you but not everything is Linux, and not every Unix has bash as default, or even on the system. You might need your arrow keys working but most of us don't. Don't be lazy and expose yourself to this sort of thing, bash is not needed, nor is it a prerequisite for anything.