> wget shells out to bash
Why oh why would this ever happen?
This hole bug is way overblown. Not every small program on the planet "shells out to bash", and if they do, thats one seriously messed up program.
Why oh why would this ever happen?
This hole bug is way overblown. Not every small program on the planet "shells out to bash", and if they do, thats one seriously messed up program.
If you run a web server that generates its own CAPTCHA using something like ImageMagick, or call system() to gzip something, you could possibly be vulnerable.
Never underestimate vulnerabilities and the way people can use them, or even combine them, to exploit systems.
Are you serious, who the hell does that!?
Any half-assed language has a zip implementation, use that. Any non-boring language has image-magick binding to that library.
This bug affects complete idiots.
Consider how many people touch an enterprise system, or even a system at a smaller shop. Consider how many people touch shared hosting servers or even dedicated boxes.
Do /you/ trust all of them, along with all the authors of all the software exposed to the web (or touched by something exposed to the web) on that system?
Seriously, if you're on shared hosting, it's almost certain that at least one person on the server is compromised/malicious