On Wed, 24 Sep 2014 18:50:05 -0400, Jim Popovitch said: > If someone is already invoking #!/bin/bash from a cgi, then they are > already doing it wrong (bash has massive bloat/overhead for a CGI script).
You sure you don't have *any* cgi's that do something like
system("mail -s 'cgi program xxyz hit fatal error' webadmin@localhost");
because all it takes is finding a way to force the fatal error while you
send a crafted User-Agent: header....
As Jim Popovitch said, bash usage is incredibly pervasive....
pgp6ZxuA0Y8R_.pgp
Description: PGP signature
