# Is Wowza affected by Shellshock / Does Wowza read/write ENV variables ?

**URL:** <https://community.wowza.com/t/is-wowza-affected-by-shellshock-does-wowza-read-write-env-variables/39505>\
**Category:** Wowza Streaming Engine\
**Created:** [October 1, 2014, 1:42pm UTC](https://community.wowza.com/t/is-wowza-affected-by-shellshock-does-wowza-read-write-env-variables/39505 "2014-10-01T13:42:48Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![noo\_noonoo](https://avatars.discourse-cdn.com/v4/letter/n/96bed5/32.png) [@noo\_noonoo](https://community.wowza.com/u/noo_noonoo)\
**Post date:** [October 1, 2014, 1:42pm UTC](https://community.wowza.com/t/is-wowza-affected-by-shellshock-does-wowza-read-write-env-variables/39505/1 "2014-10-01T13:42:48Z")

</div>

Question says it all. Cannot find anything on google or on forums regarding this or past versions of Wowza.

I highly doubt it is vulnerable (writing malicious ENV based on URL input) but it’s not impossible. Would love to have official feedback on this. Thank you!

---

<div class="post-metadata">

**Author:** ![Andrew\_Kennedy1](https://avatars.discourse-cdn.com/v4/letter/a/278dde/32.png) [@Andrew\_Kennedy1](https://community.wowza.com/u/Andrew_Kennedy1)\
**Post date:** [October 2, 2014, 1:18am UTC](https://community.wowza.com/t/is-wowza-affected-by-shellshock-does-wowza-read-write-env-variables/39505/2 "2014-10-02T01:18:31Z")

</div>

Hi,

Wowza does set some environment variables when running under Linux when starting , so

\_EXECJAVA=java

WMSAPP\_HOME=/usr/local/WowzaStreamingEngine

WMSCONFIG\_HOME=/usr/local/WowzaStreamingEngine

WMSCONFIG\_URL=

export WMSAPP\_HOME WMSCONFIG\_HOME JAVA\_OPTS \_EXECJAVA

but once running it is not possible by default to write system variables by URL input.

Andrew.

---

<div class="post-metadata">

**Author:** ![Andrew\_Kennedy1](https://avatars.discourse-cdn.com/v4/letter/a/278dde/32.png) [@Andrew\_Kennedy1](https://community.wowza.com/u/Andrew_Kennedy1)\
**Post date:** [December 25, 2014, 1:37pm UTC](https://community.wowza.com/t/is-wowza-affected-by-shellshock-does-wowza-read-write-env-variables/39505/3 "2014-12-25T13:37:05Z")

</div>

I have tested some scenarios however as with all security options testing yourself/within your own security framework should be done to ensure it meets your set level of acceptance. We would of course be keen to hear your results.

It it important to note that the vulnerability is within shell and has been identified as the area which needs resolving.

Andrew

---

<div class="post-metadata">

**Author:** ![Tahir\_Khan](https://avatars.discourse-cdn.com/v4/letter/t/6f9a4e/32.png) [@Tahir\_Khan](https://community.wowza.com/u/Tahir_Khan)\
**Post date:** [January 1, 2015, 3:26am UTC](https://community.wowza.com/t/is-wowza-affected-by-shellshock-does-wowza-read-write-env-variables/39505/4 "2015-01-01T03:26:45Z")

</div>

It is not affected.

---

<div class="post-metadata">

**Author:** ![james\_h](https://avatars.discourse-cdn.com/v4/letter/j/9de053/32.png) [@james\_h](https://community.wowza.com/u/james_h)\
**Post date:** [December 22, 2014, 4:05pm UTC](https://community.wowza.com/t/is-wowza-affected-by-shellshock-does-wowza-read-write-env-variables/39505/5 "2014-12-22T16:05:26Z")

</div>

> Hi,
> 
> Wowza does set some environment variables when running under Linux when starting , so
> 
> \_EXECJAVA=java
> 
> WMSAPP\_HOME=/usr/local/WowzaStreamingEngine
> 
> WMSCONFIG\_HOME=/usr/local/WowzaStreamingEngine
> 
> WMSCONFIG\_URL=
> 
> export WMSAPP\_HOME WMSCONFIG\_HOME JAVA\_OPTS \_EXECJAVA
> 
> but once running it is not possible by default to write system variables by URL input.
> 
> Andrew.

this answer is rather troubling in my opinion, as it really only addresses half of the issue, but anyone running it on \*nix should already know the env vars it sets.

what about tampering with user agents? or through POST requests? the way wowza operates (to my somewhat limited knowledge) would seem to imply a specially crafted POST request could be an issue.

has this been tested at all by the wowza team, or am I better off finding out on my own?