<div dir="ltr"><br><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Sep 26, 2014 at 9:31 AM, Gary Buhrmaster <span dir="ltr"><<a href="mailto:gary.buhrmaster@gmail.com" target="_blank">gary.buhrmaster@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">On Fri, Sep 26, 2014 at 4:14 PM, Mike Perkins<br>
<<a href="mailto:mikep@randomtraveller.org.uk">mikep@randomtraveller.org.uk</a>> wrote:<br>
......<br>
<span class="">> The reports I've been reading today also make the point that routers could<br>
> be vulnerable, depending on what OS they run and how things are implemented.<br>
> It is a fault in the way cgi is implemented, not just bash, and the problem<br>
> isn't restricted to port 80.<br>
<br>
</span>While many "embedded" devices use busybox, which has ash<br>
rather than bash by default, there are always exceptions.<br>
<br>
And it is not restricted to cgi. Some dhcp clients are vulnerable,<br>
and a rogue dhcp server on (say) a public wifi network is not<br>
at all unheard of.<br>
<br>
My advice is that rather than spend effort to figure out reasons<br>
not to upgrade, just do ii. Yes, test in your environment before<br>
rollout, but just do it, and move on. Patch now.<br>
<div class="HOEnZb"><div class="h5">______________________________________________<br><br></div></div></blockquote><div><br></div><div>Does this affect the DD-WRT firmware? Should users upgrade to the latest version of that? <br></div></div></div></div>