Article View: comp.unix.shell
Article #1593Re: Beware xargs security holes
From: Dan Bernstein
Date: Tue, 23 Oct 1990 21:25
Date: Tue, 23 Oct 1990 21:25
15 lines
1104 bytes
1104 bytes
In article <1890@necisa.ho.necisa.oz> boyd@necisa.ho.necisa.oz (Boyd Roberts) writes: > In article <3940@awdprime.UUCP> tif@doorstop.austin.ibm.com (Paul Chamberlain) writes: > >In any case, I've yet to see how "a malicious user [could] > >remove every file on the system." > A malicious user may be able to embed newlines in filenames, > but that's not going to trash the _whole_ file-system. Oh? Each filename he sets up can remove dozens of other files. There are only so many files in the entire system. > If someone did change xargs(1) to use system(3) it's obviously been broken. Agreed. ---Dan
Technical Details
Message-ID:
<4252:Oct2321:25:3090@kramden.acf.nyu.edu>Path:
arc1-ca.pugleaf.net!utzoo!utgpu!news-server.csri.toronto.edu!cs.utexas.edu!swrinde!ucsd!sdd.hp.com!uakari.primate.wisc.edu!aplcen!haven!adm!cmcl2!kramden.acf.nyu.edu!brnstndReferences:
<tim.656101080@ggumby> <3940@awdprime.UUCP> <1890@necisa.ho.necisa.oz>Show Full Headers
Complete Article Headers
Path: arc1-ca.pugleaf.net!utzoo!utgpu!news-server.csri.toronto.edu!cs.utexas.edu!swrinde!ucsd!sdd.hp.com!uakari.primate.wisc.edu!aplcen!haven!adm!cmcl2!kramden.acf.nyu.edu!brnstnd From: brnstnd@kramden.acf.nyu.edu (Dan Bernstein) Newsgroups: comp.unix.shell Subject: Re: Beware xargs security holes Message-ID: <4252:Oct2321:25:3090@kramden.acf.nyu.edu> Date: 23 Oct 90 21:25:30 GMT References: <tim.656101080@ggumby> <3940@awdprime.UUCP> <1890@necisa.ho.necisa.oz> Organization: IR Lines: 15