Re: Shellshock

Java containers are probably fine.  The workaround seems to be install the
patches from the upstream groups.

Right now just make sure that you disable any kind of anonymous access to
things which run bash scripts.  cgi-bin, services over ssh, etc.

Summers Pittman
>>Phone:404 941 4698
>>Java is my crack.


On Fri, Sep 26, 2014 at 4:08 PM, Vinny <[email protected]> wrote:

> I heard about this. Any emerging workarounds? I'm guessing this has been
> an unknown vulnerability for a while since it effects so many *nixes ?
> Would Java Containers be vulnerable to the same kind of header injections?
>
> --
> biz: http://www.linkedin.com/in/vincentstoessel/
> personal: http://earthlight.co
>
> On Fri, Sep 26, 2014 at 4:04 PM, Summers Pittman ℝ <[email protected]>
> wrote:
>
>>
>> If you guys haven't heard, there is a pretty big vulnerability in bash
>> called Shellshock.  It affects most versions of Bash on Windows, Linux,
>> BSD, and Mac.
>>
>> This is a remote code execution bug involving the way Bash resolves
>> environment variables.  Basically you can define a variable as a function
>> and have that function executed as part of bash assigning the value.  One
>> affected application, Apache, uses bash variables to pass HTTP request
>> headers to cgi scripts.  This means that a well crafted HTTP header can
>> execute code if you run a cgi script.
>>
>> Just your friendly hide yo wife, hide yo kids, update yo servers reminder.
>>
>> Summers Pittman
>> >>Phone:404 941 4698
>> >>Java is my crack.
>>
>>
>> _______________________________________________
>> ajug-members mailing list
>> [email protected]
>> http://lists.ajug.org/mailman/listinfo/ajug-members
>>
>>
>
> _______________________________________________
> ajug-members mailing list
> [email protected]
> http://lists.ajug.org/mailman/listinfo/ajug-members
>
>

_______________________________________________
ajug-members mailing list
[email protected]
http://lists.ajug.org/mailman/listinfo/ajug-members