Article View: comp.security.misc
Article #515Re: Setuid script - is this unsecure? (perl)
From: matthew aardvarkious
Date: Wed, 11 Nov 1992 09:47
Date: Wed, 11 Nov 1992 09:47
17 lines
1384 bytes
1384 bytes
jbotz@mtholyoke.edu (Jurgen Botz) writes: >In article <AMOSS.92Nov6102549@shuldig.cs.huji.ac.il> amoss@shuldig.cs.huji.ac.il (Amos Shapira) writes: >>If you want an suid programme write it in C (even if it does dumb things) and >>don't use the system(3) and popen(3) functions because they call /bin/sh and >>hance it's almost like writing a shell script. I bet people can find some more >>rules-of-thumb but these are the very basic ones you should follow. >Or better yet, use Perl, which won't allow you to perform "unsafe" operations >when running setuid. 2 points! -- These are my personal views and do not reflect those of Melbourne University. Anything I may say that may be deemed offensive and/or damaging should NOT be redirected to administration, as they have had nothing to do with it. Please direct any/all complaints/enquiries to thecure@ee.mu.oz.au
Technical Details
Message-ID:
<thecure.721475248@munagin>Path:
arc1-ca.pugleaf.net!sparky!uunet!munnari.oz.au!cs.mu.OZ.AU!thecureReferences:
<1992Nov5.071354.24042@kth.se> <AMOSS.92Nov6102549@shuldig.cs.huji.ac.il> <BxJ9zK.Ltz@mtholyoke.edu>Show Full Headers
Complete Article Headers
Newsgroups: comp.security.misc Path: arc1-ca.pugleaf.net!sparky!uunet!munnari.oz.au!cs.mu.OZ.AU!thecure From: thecure@mullian.ee.mu.OZ.AU (matthew aardvarkious) Subject: Re: Setuid script - is this unsecure? (perl) Message-ID: <thecure.721475248@munagin> Sender: news@cs.mu.OZ.AU Organization: Computer Science, University of Melbourne, Australia References: <1992Nov5.071354.24042@kth.se> <AMOSS.92Nov6102549@shuldig.cs.huji.ac.il> <BxJ9zK.Ltz@mtholyoke.edu> Date: Wed, 11 Nov 1992 09:47:28 GMT Lines: 17