Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 24 Sep 2014 19:19:05 +0200
From: Florian Weimer <>
Subject: Re: CVE-2014-6271: remote code execution through bash

On 09/24/2014 07:03 PM, Hanno Böck wrote:
> On Wed, 24 Sep 2014 18:30:35 +0200
> Florian Weimer <> wrote:
>> This depends on how PHP is invoked.  mod_php does not set the CGI
>> environment variables.
>> However, it is true that if CGI programs spawn subprocesses, they may
>> be affected even if the CGI program itself is not written in bash.
> Regarding php, isn't it quite common to run it through mod_fcgid with a
> (bash) wrapper script? At least that's what apache wiki documents:

I don't know what's common with PHP.  I don't think there is much public 
documentation about what it takes to run PHP at scale in a secure 
fashion (also taking compromised or downright malicious customers into 

> So that'd mean many php installations are affected even if they don't
> use subprocesses.
> I'm not sure if this wrapper can be avoided.

The wrapper does not run per request.  I have not tested this, but I 
don't think it sees any request-specific environment variables at this 
point.  FCGI transfers request information over a socket at descriptor 0 
and not through environment variables.

Florian Weimer / Red Hat Product Security

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.