Messages in this thread | | | Subject | Re: hard links create local DoS vulnerability and security proble | From | Valdis.Kletnieks@vt ... | Date | Mon, 24 Nov 2003 15:00:27 -0500 |
| |
On Mon, 24 Nov 2003 14:25:31 EST, Mathieu Chouquet-Stringer said:
> It's always been my understanding that you cannot have suid shell script > because you could easily change the IFS. Am i wrong? (
IFS is just one of the *many* issues (there's also a ton of race conditions caused by #! handling, among other things).
You don't like the shell script, feel free to substitude in the C-language equivalent that was posted previously :)
(And yes, I did it intentionally - figuring that at least one user on the list would actually do it and leave a set-UID something lying around to shoot themselves in the foot with, so weaponry loaded with blanks seemed a good idea... ;)
[unhandled content-type:application/pgp-signature] | |