My company's McAfee system detected many "http CSH bash ShellShock code injection attacks" attempts on a Windows 2008 server running Apache Tomcat Coyote. Does this config present a potential attack on the server or is it just an attempt that could not harm the system while it is on a Windows machine ?

1 Answer 1


Shellshock is a vulnerability in the bash interpreter which is mostly used on Unix-like systems but has been ported to Windows.

However, Apache Tomcat, when running on windows, does not include bash by default and doesn't have CGI enabled by default either.

So, generally speaking, no, Apache Tomcat running under windows is not vulnerable. To be sure, however, you have to verify that bash hasn't been installed and used as the interpreter for CGI programs (which is sometimes done by third parties to deploy Unix software on Windows).

  • Bash is a shell, not an interpreter. It uses an interpreted language, to be sure, but that doesn't make it an interpreter.
    – Mike Scott
    Dec 19, 2014 at 10:51
  • 1
    @MikeScott If you insist on terminology, have a look at the first line of the wikipedia article about UNIX Shells: en.wikipedia.org/wiki/Unix_shell "A Unix shell is a command-line interpreter". That being said, I'm not sure that is even worth discussing, really...
    – Stephane
    Dec 19, 2014 at 10:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .