3

According to Red Hat

httpd (attack vector):

CGI scripts are likely affected by this issue: when a CGI script is run by the web server, it uses environment variables to pass data to the script. These environment variables can be controlled by the attacker. If the CGI script calls Bash, the script could execute arbitrary code as the httpd user. mod_php, mod_perl, and mod_python do not use environment variables and we believe they are not affected.

mod_php is not vulnerable to CVE-2014-6271 and CVE-2014-7169 because it does not use environment variables. Does mod_fcgid 2.x use environment variables?

Improve this question

1 Answer 1

Reset to default
1

mod_fcgi itself is not vulnerable: it talks to Apache through interprocess communication rather than the environment variables of traditional CGI. Any CGI scripts run through mod_fcgi can still be vulnerable if 1) they can be coerced into setting environment variables and 2) invoke bash (say, through a system() call or backtick interpolation).

Improve this answer
2
  • whats a backtick interpolation?
    – Gaia
    Sep 25, 2014 at 22:12
  • 1
    @Gaia, In Perl, it's a way to run an external command and capture the output into a variable.
    – Mark
    Sep 25, 2014 at 22:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .