Full Disclosure mailing list archives
Re: getenv("=A") works (no particular vulnerability)
From: bo0od via Fulldisclosure <fulldisclosure () seclists org>
Date: Sat, 5 Feb 2022 07:10:03 +0000
post it to glibc (there are devs,ticket system, community..) https://www.gnu.org/software/libc/ Askar Safin via Fulldisclosure:
TL;DR: this mail doesn't contain any actual vulnerability, just an idea. Consider this C code for Linux and glibc: --------- #define _GNU_SOURCE 1 #include <stdio.h> #include <stdlib.h> #include <unistd.h> char *new_env[] = {"=A=B", 0}; int main () { environ = new_env; printf("%s\n", getenv("=A")); // prints "B" return 0; } --------- This code prints "B". I. e. glibc allows variables starting with "=". It is quite possible such behavior can lead to various vulnerabilities. It is possible this list is inappropriate for such message. If so, please, say, where I should post such message next time. == Askar Safin http://safinaskar.com https://sr.ht/~safinaskar https://github.com/safinaskar _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
_______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
Current thread:
- getenv("=A") works (no particular vulnerability) Askar Safin via Fulldisclosure (Feb 04)
- Re: getenv("=A") works (no particular vulnerability) Andy Bach (Feb 06)
- Re: getenv("=A") works (no particular vulnerability) bo0od via Fulldisclosure (Feb 06)