3

According to Red Hat

httpd (attack vector):

CGI scripts are likely affected by this issue: when a CGI script is run by the web server, it uses environment variables to pass data to the script. These environment variables can be controlled by the attacker. If the CGI script calls Bash, the script could execute arbitrary code as the httpd user. mod_php, mod_perl, and mod_python do not use environment variables and we believe they are not affected.

mod_php is not vulnerable to CVE-2014-6271 and CVE-2014-7169 because it does not use environment variables. Does mod_fcgid 2.x use environment variables?

1

mod_fcgi itself is not vulnerable: it talks to Apache through interprocess communication rather than the environment variables of traditional CGI. Any CGI scripts run through mod_fcgi can still be vulnerable if 1) they can be coerced into setting environment variables and 2) invoke bash (say, through a system() call or backtick interpolation).

  • whats a backtick interpolation? – Gaia Sep 25 '14 at 22:12
  • 1
    @Gaia, In Perl, it's a way to run an external command and capture the output into a variable. – Mark Sep 25 '14 at 22:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.