Sponsored Content
Special Forums Cybersecurity 'Shell Shock' vulnerability in Bourne shell Post 302918938 by achenle on Friday 26th of September 2014 09:42:52 AM
Old 09-26-2014
Not the way I understand it.

Any environment variable can be used to trigger the vulnerability.

CGI arguments are passed as environment variables (CGI, not fast CGI):

Common Gateway Interface - Wikipedia, the free encyclopedia

vs

FastCGI - Wikipedia, the free encyclopedia

So any bash CGI scripts - or any bash scripts called by any CGI process - are vulnerable.

And SSH accounts are vulnerable if you allow the remote user to set ANY environment variables, such as LC_* for localization.
 

10 More Discussions You Might Find Interesting

1. Shell Programming and Scripting

Bourne Shell and Arrays

Hi everyone, first post here so please be gentle :-) I normally likle to script in Bourne Shell simply for guarenteed compatibility across any system I might run across but this latest problem has me stumped. Arrays is a rather significant construct missing from sh and after finding a way to... (2 Replies)
Discussion started by: Unbeliever
2 Replies

2. UNIX for Dummies Questions & Answers

Bourne-again shell

Hi guys !! well i'm still new in learning UNIX , and actually i'm still studying it by myself .. anyway, some people told me the Bourne-again shell is a good version of UNIX to work on , and i tried to download yesterday but i didn't know how to start it ...... the ReadMe file associated with... (3 Replies)
Discussion started by: mrsamer
3 Replies

3. UNIX for Dummies Questions & Answers

bourne shell or korn shell?

Hi, I have a script that uses "nohup" command to execute a korn shell script. Which one is the correct shell to use bourne shell or korn shell to execute a korn shell? and why? Thanks in advanced. (2 Replies)
Discussion started by: XZOR
2 Replies

4. Shell Programming and Scripting

C shell & Bourne Shell

Hi Guys, My first post and simple one at that .. Really rusty with this shell scripting..\ I have a script called .. j.sh I am calling > j.sh LOG_PATH $BLMBRGDATA/blmbrg.properties where j.sh is grep $1 $2 | cut -d',' -f2 . $BLMBRGDATA is set to a directory path. why do i get :- $... (3 Replies)
Discussion started by: jsm66
3 Replies

5. Shell Programming and Scripting

I need to understand the differences between the bash shell and the Bourne shell

I do not claim to be an expert, but I have done things with scripts that whole teams of folks have said can not be done. Of course they should have said we do not have the intestinal fortitude to git-r-done. I have been using UNIX actually HPUX since 1992. Unfortunately my old computer died and... (7 Replies)
Discussion started by: awk_sed_hello
7 Replies

6. Shell Programming and Scripting

How to activate Korn Shell functionnalities in Bourne Shell

Hi All I have writing a Korn Shell script to execute it on many of our servers. But some servers don't have Korn Shell installed, they use Borne Shell. Some operations like calculation don't work : cat ${file1} | tail -$((${num1}-${num2})) > ${file2} Is it possible to activate Korn Shell... (3 Replies)
Discussion started by: madmat
3 Replies

7. Shell Programming and Scripting

Is there any command in the Bourne shell?

Hi, The problem I have is that I want to create a list of folders whose names are read from a text file but the file names are in decimal. Each letter consists of an octet and the end of the folder name is defined by the white space character (0032) For example, we have in the text... (2 Replies)
Discussion started by: Gengis-Kahn
2 Replies

8. Shell Programming and Scripting

help with bourne shell script

Attempting to write a script to eventually notify me via email for when there is packetloss across the backbone. I am looking for values greater than 0% in the mtr field. #!/bin/sh target=www.google.com date +"%D"_"%T" >> /home/rich/mtr.log echo "----------------------------------------" >>... (1 Reply)
Discussion started by: closedown
1 Replies

9. Shell Programming and Scripting

Bourne/C shell help

Exercise Five Write a Bourne shell script which: • Professionalism: plan for this from the start. • Has one command line argument. • If the command line argument is a directory then the script should output the number of files in the directory. • If the command line argument is an ordinary... (2 Replies)
Discussion started by: moesom
2 Replies

10. Shell Programming and Scripting

Bourne shell & Korn shell

Could some one tell me the difference btw Bourne shell and the Kshell? Which is more flexible and reliable in terms of portability and efficiency. When i type the following command .. $ echo $SHELL yields me /bin/sh Does this tells me that I am in Bourne shell. If yes, how can i get... (6 Replies)
Discussion started by: bobby1015
6 Replies
CGI::Fast(3pm)						 Perl Programmers Reference Guide					    CGI::Fast(3pm)

NAME
CGI::Fast - CGI Interface for Fast CGI SYNOPSIS
use CGI::Fast qw(:standard); $COUNTER = 0; while (new CGI::Fast) { print header; print start_html("Fast CGI Rocks"); print h1("Fast CGI Rocks"), "Invocation number ",b($COUNTER++), " PID ",b($$),".", hr; print end_html; } DESCRIPTION
CGI::Fast is a subclass of the CGI object created by CGI.pm. It is specialized to work well FCGI module, which greatly speeds up CGI scripts by turning them into persistently running server processes. Scripts that perform time-consuming initialization processes, such as loading large modules or opening persistent database connections, will see large performance improvements. OTHER PIECES OF THE PUZZLE
In order to use CGI::Fast you'll need the FCGI module. See http://www.cpan.org/ for details. WRITING FASTCGI PERL SCRIPTS
FastCGI scripts are persistent: one or more copies of the script are started up when the server initializes, and stay around until the server exits or they die a natural death. After performing whatever one-time initialization it needs, the script enters a loop waiting for incoming connections, processing the request, and waiting some more. A typical FastCGI script will look like this: #!/usr/bin/perl use CGI::Fast; &do_some_initialization(); while ($q = new CGI::Fast) { &process_request($q); } Each time there's a new request, CGI::Fast returns a CGI object to your loop. The rest of the time your script waits in the call to new(). When the server requests that your script be terminated, new() will return undef. You can of course exit earlier if you choose. A new version of the script will be respawned to take its place (this may be necessary in order to avoid Perl memory leaks in long-running scripts). CGI.pm's default CGI object mode also works. Just modify the loop this way: while (new CGI::Fast) { &process_request; } Calls to header(), start_form(), etc. will all operate on the current request. INSTALLING FASTCGI SCRIPTS
See the FastCGI developer's kit documentation for full details. On the Apache server, the following line must be added to srm.conf: AddType application/x-httpd-fcgi .fcgi FastCGI scripts must end in the extension .fcgi. For each script you install, you must add something like the following to srm.conf: FastCgiServer /usr/etc/httpd/fcgi-bin/file_upload.fcgi -processes 2 This instructs Apache to launch two copies of file_upload.fcgi at startup time. USING FASTCGI SCRIPTS AS CGI SCRIPTS
Any script that works correctly as a FastCGI script will also work correctly when installed as a vanilla CGI script. However it will not see any performance benefit. EXTERNAL FASTCGI SERVER INVOCATION
FastCGI supports a TCP/IP transport mechanism which allows FastCGI scripts to run external to the webserver, perhaps on a remote machine. To configure the webserver to connect to an external FastCGI server, you would add the following to your srm.conf: FastCgiExternalServer /usr/etc/httpd/fcgi-bin/file_upload.fcgi -host sputnik:8888 Two environment variables affect how the "CGI::Fast" object is created, allowing "CGI::Fast" to be used as an external FastCGI server. (See "FCGI" documentation for "FCGI::OpenSocket" for more information.) FCGI_SOCKET_PATH The address (TCP/IP) or path (UNIX Domain) of the socket the external FastCGI script to which bind an listen for incoming connections from the web server. FCGI_LISTEN_QUEUE Maximum length of the queue of pending connections. For example: #!/usr/local/bin/perl # must be a FastCGI version of perl! use CGI::Fast; &do_some_initialization(); $ENV{FCGI_SOCKET_PATH} = "sputnik:8888"; $ENV{FCGI_LISTEN_QUEUE} = 100; while ($q = new CGI::Fast) { &process_request($q); } CAVEATS
I haven't tested this very much. AUTHOR INFORMATION
Copyright 1996-1998, Lincoln D. Stein. All rights reserved. This library is free software; you can redistribute it and/or modify it under the same terms as Perl itself. Address bug reports and comments to: lstein@cshl.org BUGS
This section intentionally left blank. SEE ALSO
CGI::Carp, CGI perl v5.16.2 2012-10-11 CGI::Fast(3pm)
All times are GMT -4. The time now is 01:20 AM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy