Bugtraq mailing list archives

Re: SUID shell scripts, questions?


From: fred () nasirc hq nasa gov (Fred Blonder)
Date: Mon, 13 Feb 1995 09:25:53 -0500


        From: woods () ncar ucar edu (Greg Woods)

        . . .  you could always overwrite the SAME file with
        something new, so the fd doesn't change.

Now wait a minute!  If someone can overwrite the SAME file you're
potentially hosed whether or not that file is a shell script or a
binary.  If you execute a file that's world-writwable, or writable by
anyone untrusted, you're leaving yourself open.



Current thread: