Is my understanding correct that in order to exploit via "Shell Shock", binary we influence needs to execute bash (and we need to have influence on command line)?
Therefore, am I correct,
that if binary does not execute bash directly,
and does not use
system() system call (which uses shell for command evaluation),
but, instead, calls helper programs via system calls from
exec() family (or loads via dynamic loading like ld etc), than given binary is "shell shock" safe?
(Of course it applies transitively, if we can influence how helper apps are calling their helper apps)
And if system exposes only such binaries to inputs from external world, that given system is "shell shock" safe ?
(Therefore, checking for lack of
system() calls and
exec() calls of bash is good audit evaluation criteria?)