[CentOS] firefox: annoyance

Valeri Galtsev

galtsev at kicp.uchicago.edu
Sat Sep 27 00:26:01 UTC 2014


On Fri, September 26, 2014 6:05 pm, John R Pierce wrote:
> On 9/26/2014 3:36 PM, Valeri Galtsev wrote:
>> On Fri, September 26, 2014 5:13 pm, John R Pierce wrote:
>>> >On 9/26/2014 2:51 PM, Always Learning wrote:
>>>> >>Probably all Windoze
>>> >
>>> >linux apache web servers with the bash exploit are getting owned en
>>> >masse today.     my (patched) internet web server has logged 100s and
>>> >100s of attempts like...
>>> >
>>> >66.186.2.172 - - [26/Sep/2014:00:49:29 -0700] "GET /cgi-bin/test.sh
>> I feel really stupid, but I have to ask. If your server wasn't patched,
>> it
>> only would have owned by the above if that file exists, is executable by
>> apache and it indeed invokes bash (say, has #!/bin/bash or whatever bash
>> location is as first line), right?
>
> no.  mod_cgi launches /bin/sh and passes it the command,  even if the
> file doesn't exist.   and  /bin/sh

Damn, indeed it is not sh, but symlink to bash. Crap! Am I already to that
extent FreeBSD and not Linux guy...

Ba

Valeri


++++++++++++++++++++++++++++++++++++++++
Valeri Galtsev
Sr System Administrator
Department of Astronomy and Astrophysics
Kavli Institute for Cosmological Physics
University of Chicago
Phone: 773-702-4247
++++++++++++++++++++++++++++++++++++++++



More information about the CentOS mailing list