Beefy Boxes and Bandwidth Generously Provided by pair Networks
Pathologically Eclectic Rubbish Lister

Re: Re: Dangerous diamonds!

by dws (Chancellor)
on May 18, 2003 at 15:57 UTC ( #258993=note: print w/replies, xml ) Need Help??

in reply to Re: Dangerous diamonds!
in thread Dangerous diamonds!

BTW, who runs oneliners as root? (i'd consider that a bug)

It's not just one-liners, and it's not just root. Any script that doesn't untaint ARGV is vulnerable. Partly, that vulnerability is incidental, given that once someone has broken into an account it is a lot easier for them to do damage directly, rather than wasting time attacking some Perl script.

Very few Perl books talk about ARGV being a vulnerability. Or if they do, it's in passing in one part of the book, with examples in other parts ignoring the hazard.

Replies are listed 'Best First'.
Re: Re: Re: Dangerous diamonds!
by Juerd (Abbot) on May 18, 2003 at 16:18 UTC

    Any script that doesn't untaint ARGV is vulnerable.

    Which is this thread's lesson :)

    But I still think magic ARGV should not use two-arg open.

    Juerd # { site => '', plp_site => '', do_not_use => 'spamtrap' }

Log In?

What's my password?
Create A New User
Node Status?
node history
Node Type: note [id://258993]
and the web crawler heard nothing...

How do I use this? | Other CB clients
Other Users?
Others scrutinizing the Monastery: (8)
As of 2020-01-21 17:47 GMT
Find Nodes?
    Voting Booth?