[Cialug] Shellshock Bash Remote Code Execution Vulnerability

[Scott Yates]

Help me understand a couple thingss:

How is this operating remotely?  I understand this being a problem if
people have shell access to a box, but how is it that anything "remote" is
allowed to set an environment variable in the first place?
​
​Am I missing something here, or is this only a problem if someone already
has shell access?​