Slashdot is powered by your submissions, so send in your scoop

 



Forgot your password?
typodupeerror
×

Comment Re:not supposed to be on the web! (Score 1) 329

If you assume you are not you are being an idiot.

I'm sure people didn't think their DHCP client ran a bash script after injecting some remote data into the environment, as the obvious example.

Do you run qmail? Oops, hopefully no users have a .qmail file.

Exim or postfix? You've checked all the things they execute I take it, and all the things that those things execute and so on?

Users using procmail? None of them have an exploitable match (or are adding one a minute after you checked them all)?

If you admin a bunch of web servers are you sure that there isn't a CGI script somewhere? Are you sure it doesn't call system()/popen() anywhere?

Comment Re:Mod parent up. (Score 1) 907

It's a trade off. You pay the large taxi fares occasionally in order to not pay the larger expenses that come from owning a car. Whether that is a good choice or not depends on the relative costs of both options which will end up depending on just how often you need to use a taxi.

Comment Re:Mod parent up. (Score 1) 907

Surely your boss ask you to work on every single one of them. If so and you have no friends to get a lift from then sure relying on public transport in that particular situation probably wouldn't be wise.

Back in the real world I've managed to keep a job for a decade without having a driving license.

Comment Re:Why is this a real problem? (Score 1) 318

You wouldn't and that isn't the issue - anyone who has bash directly accessible as a cgi already had a security hole - well more a design...

It's not that uncommon to have a cgi that grabs some data from a web form, validate that data, and then call some existing executable to actually do the work. Calling "sendmail" to send mail isn't exactly unheard of.

As for DHCP I'd take the guess that the user would be root - given it will be configuring network devices and so on. But I don't care enough to check ...

Comment Re:"could be worse than Heartbleed" (Score 4, Informative) 318

You don't need to use bash as the cgi handler. You just have to execute bash from your cgi handler. Say by the system() function in the c library on a system where /bin/sh is bash.

And of course connecting having your linux machine try and get an IP via DHCP is a vector.

Comment Re:Terrific counter to Monsanto's herbicide messag (Score 4, Insightful) 308

No that's because use huge amounts of natural gas (half a billion tonnes or so a year) to create nitrogen fertilizers. And even more pesticides.

Which don't get me wrong, I'm all for. But modern farming sacrifices some land productivity in exchange for much higher labor productivity.

We use tidy rows of monoculture because it allows extremely efficient harvesting, not because it has better yields.

Comment Re:Only CGI scripts affected? (Score 1) 399

Or a CGI script written in a some other lanaguage - like python or perl - or a binary that is on a system with bash as the default shell and which calls the system function in libc (or an equivalent) since that will execute /bin/sh.

There will be a lot of such cases - running a "mail" command or something from imagemagick and so on.

Comment Re:Emma Watson is full of it (Score 1) 590

Those are outcomes not opportunities. That there are female members of parliament and CEOs indicates that there is some opportunity (but not whether or not it is equal).

It's pretty well known that Psychopaths make up a higher percentage of business and government leaders - and business more than government - than the they do in the general population. Psychopathy is also more common in men than women. So there's one possible (though unlikely to be the entire story) other explanation - psychopaths make better (taking better to mean more successful and measuring success merely by being there) CEOs and politicians, psychopaths are mostly men, those two factors that have nothing to do with "equal opportunities" result in the vast majority of CEOs and politicians being men.

Slashdot Top Deals

UNIX is hot. It's more than hot. It's steaming. It's quicksilver lightning with a laserbeam kicker. -- Michael Jay Tucker

Working...