Tag Info

New answers tagged

0

Some Aftermarket Android ROMs like CM are vulnerable, because they have the bash shell in their ROMs integrated. CM fixed their Nightlies. I tried the official test script on my Android Devices (all with Custom ROMs) and all were vulnerable.


0

This is very difficult to answer, as no one here does know how your application is built. As long as you are not executing (either directly or indirectly) any system commands your application should be save. There is only a risk when you execute commands (either directly or indirectly) in the shell out of your application. This risk is very high if you ...


3

I have run the official test script on my Samsung Galaxy Tab 10.1 and it indicates it is vulnerable. This device was just out of the box and has not been rooted.


1

To add to what Mark said, it's also worth noting that execlp, execvp, and execvpe all invoke /bin/sh, as that's how they perform their path lookups. So, even without the 2nd-generational effects Mark mentions, just using the exec* family of functions does not guarantee bash will not be invoked. The correct fix is to make sure you have installed a patched ...


5

Wrong on both counts. In order to exploit the "shellshock" vulnerability, an attacker needs to control at least one environment variable (easy to do through CGI, SSH, or DHCP), and bash needs to be invoked at some point with the modified environment: directly as the result of an exec(), indirectly through system() or equivalent, highly indirectly through ...


7

Not out-of-the-box. I know of no Android or iOS device running a bash shell. Some people might, on their rooted devices, but that will be only a few.



Top 50 recent answers are included