Re: Beware xargs security holes

Article View: comp.unix.shell

Article #1599

#1599

From: Conor P. Cahill
Date: Wed, 24 Oct 1990 01:00

12 lines
1277 bytes

In article <1890@necisa.ho.necisa.oz> boyd@necisa.ho.necisa.oz (Boyd Roberts) writes:
>Nor can I.  Since when did xargs(1) use system(3)?

It dosn't matter what xargs uses to run the command.  The problem is how
it parses it's input.  If the input is newline separated and a user can
add newlines to a filename, then the user can create a file that will
cause xargs to incorrectly parse it's input.

-- 
Conor P. Cahill            (703)430-9247        Virtual Technologies, Inc.,
uunet!virtech!cpcahil                           46030 Manekin Plaza, Suite 160
                                                Sterling, VA 22170

Technical Details

Message-ID: <1990Oct24.010007.817@virtech.uucp>

Path: arc1-ca.pugleaf.net!utzoo!utgpu!watserv1!watmath!att!rutgers!cs.utexas.edu!uunet!virtech!cpcahil

References:

<63404@iuvax.cs.indiana.edu> <1990Oct9.172621.13484@cbnews.att.com> <271653D6.1CE8@tct.uucp> <4062:Oct1518:22:1290@kramden.acf.nyu.edu> <3876@awdprime.UUCP> <tim.656101080@ggumby> <3940@awdprime.UUCP> <1890@necisa.ho.necisa.oz>

Show Full Headers

Complete Article Headers

Path: arc1-ca.pugleaf.net!utzoo!utgpu!watserv1!watmath!att!rutgers!cs.utexas.edu!uunet!virtech!cpcahil
From: cpcahil@virtech.uucp (Conor P. Cahill)
Newsgroups: comp.unix.shell
Subject: Re: Beware xargs security holes
Message-ID: <1990Oct24.010007.817@virtech.uucp>
Date: 24 Oct 90 01:00:07 GMT
References: <63404@iuvax.cs.indiana.edu> <1990Oct9.172621.13484@cbnews.att.com> <271653D6.1CE8@tct.uucp> <4062:Oct1518:22:1290@kramden.acf.nyu.edu> <3876@awdprime.UUCP> <tim.656101080@ggumby> <3940@awdprime.UUCP> <1890@necisa.ho.necisa.oz>
Reply-To: cpcahil@virtech.UUCP (Conor P. Cahill)
Organization: Virtual Technologies Inc., Sterling VA
Lines: 12

Reply to Parent Message