Beefy Boxes and Bandwidth Generously Provided by pair Networks
Do you know where your variables are?

Re: Perl Security Testing

by Anonymous Monk
on Jul 24, 2017 at 19:23 UTC ( #1195906=note: print w/replies, xml ) Need Help??

in reply to Perl Security Testing

Bugs in perl are only a security problem if you have a Perl program running with elevated privileges. One way of doing that is with setuid, but suidperl has a rocky security history and seems not to be used very much any more. Another way is if you allow users to run Perl scripts with sudo.

Replies are listed 'Best First'.
Re^2: Perl Security Testing
by Your Mother (Bishop) on Jul 24, 2017 at 21:13 UTC

    This is a strange answer and on its face seems quite wrong. Bugs in Perl could be serious problems regardless of privileges unless one takes the most pedantic and unlikely view where a DB security hole isnt a problem since no user has permission to update the DB. Even then, there have been bugs now and then that allow trivial DoS and such. Having a site like down for 1 minute is millions of dollars. That is a huge problem.

      Yes, I suppose I shouldn't have assumed you would read the rest of the thread for context. If you are going to give someone shell access, there are a million ways they could DoS you, so don't give people shell accounts on an important server. But that doesn't have anything to do with perl bugs.

      Not entirely sure where you're going with the DB thing. If you have a Perl program that mediates access to a database that's not accessible any other way, then yes, a perl bug could compromise your database. But in that situation, the program has "elevated privileges" in a sense, even if that isn't implemented with OS-level permissions.

      a site

      What "a site"?

      One name is not one "a site"

        Ah, well, you did show me wrong on one thing. I thought I was replying to sundialsvc4 posting anonymously. The hand-wavy, half-right schtick is strictly Trdϵmrkd, you know.

Log In?

What's my password?
Create A New User
Node Status?
node history
Node Type: note [id://1195906]
and the web crawler heard nothing...

How do I use this? | Other CB clients
Other Users?
Others pondering the Monastery: (4)
As of 2019-10-21 02:44 GMT
Find Nodes?
    Voting Booth?