[fossil-users] security notice for _potential_ problem with _some_ CGI-hosted repos

2014-09-25 Thread Stephan Beal
Hi, all, My mother just sent me this, bless her heart: http://www.wired.com/2014/09/internet-braces-crazy-shellshock-worm/ Management summary: CGI scripts which use bash (as opposed to /bin/sh, with the caveat that /bin/sh is an alias for bash on some systems) might _potentially_ be affected.

Re: [fossil-users] security notice for _potential_ problem with _some_ CGI-hosted repos

2014-09-25 Thread Stephan Beal
On Thu, Sep 25, 2014 at 6:43 PM, Stephan Beal sgb...@googlemail.com wrote: Some of this article is downright FUD[1], some of it is not _necessarily_ FUD. i pass it on primarily because all my CGI Fossil repos (currently) use /bin/bash instead of /bin/sh (will be resolved momentarily).

Re: [fossil-users] security notice for _potential_ problem with _some_ CGI-hosted repos

2014-09-25 Thread Richard Hipp
On Thu, Sep 25, 2014 at 12:46 PM, Stephan Beal sgb...@googlemail.com wrote: On Thu, Sep 25, 2014 at 6:43 PM, Stephan Beal sgb...@googlemail.com wrote: Some of this article is downright FUD[1], some of it is not _necessarily_ FUD. i pass it on primarily because all my CGI Fossil repos

Re: [fossil-users] security notice for _potential_ problem with _some_ CGI-hosted repos

2014-09-25 Thread Stephan Beal
On Thu, Sep 25, 2014 at 7:10 PM, Richard Hipp d...@sqlite.org wrote: The Fossil binaries on the www.fossil-scm.org server run inside a chroot jail that omits both /bin/bash and /bin/sh. In fact, that chroot jail has very little in it at all. None of the standard system utilities. No shared

Re: [fossil-users] security notice for _potential_ problem with _some_ CGI-hosted repos

2014-09-25 Thread Scott Robison
On Thu, Sep 25, 2014 at 10:43 AM, Stephan Beal sgb...@googlemail.com wrote: My mother just sent me this, bless her heart: http://www.wired.com/2014/09/internet-braces-crazy-shellshock-worm/ Management summary: CGI scripts which use bash (as opposed to /bin/sh, with the caveat that /bin/sh