Are Bitcoin exchanges safe after ShellShock ?

[BitCoinDream]

I have read ShellShock opens up Apache vulnerability. AFAIK most of the Bitcoin exchanges are running on Apache. So are they just awaiting to be ripped off ?

p.s. If U dont know what is ShellShock, check here.

[RustyNomad]

No exchange is safe in my opinion, no matter how they harp on about their 100% security.

[BitCoinDream]

No exchange is safe in my opinion, no matter how they harp on about their 100% security.

If Apache is affected, then practically very few websites are safe now, because Apache has become almost synonymous to web server. So if Apache is attacked, the result will be catastrophe including the banking systems and the heat on bitcoin exchanges will be negligible to that.

[1Referee]

Any service involved with Bitcoin will never be safe.

The only thing they can do is keep the security spot on, and detect any security holes before hackers do.

[newyorker91]

yeah trading became dangerous...

[Tzupy]

After? They probably patched their Linux servers by now, but the problem existed for over 20 years, who knows if it was already exploited?

[ArticMine]

If they are running GNU/Linux on their servers and have fully patched their servers they are not vulnerable (this is the most likely scenario).
If they are running GNU/Linux on their servers and have not patched their servers they are vulnerable.
If they are running Microsoft Windows Server on their servers they are not vulnerable.
If they are running Apple Server on their servers they are vulnerable (Apple has yet to issue any patches).

[moni3z]

If they have CGI scripts that call /bin/bash then they were vuln, or if they had any library on their system that called bash it was only one unauthenticated GET req from being totally pwned.

[Tzupy]

http://arstechnica.com/security/2014/09/still-more-vulnerabilities-in-bash-shellshock-becomes-whack-a-mole/

[PenAndPaper]

I guess they hold the majority of their coins in cold storage... or they should anyway..

[japandrew73]

is BTC-e affected by this?

[RedDiamond]

You can use this page for testing: http://shellshocktest.com/

'This tool helps you to check if your server is vulnerable to CVE-2014-6271, also known as "ShellShock".'