Re: Abusing TZ for fun (and little profit)

[Jakub Wilk <jwilk () jwilk net>]

* Jakub Wilk <jwilk () jwilk net>, 2014-10-16, 00:35:
> By default, sudo preserves the TZ variable[1] from user's environment. 
> This is a bad idea on glibc systems, where TZ can be abused to trick 
> the program to read an arbitrary file.

Oh, and the glibc's tzfile parser is apparently not very robust:
https://bugs.debian.org/772705

--
Jakub Wilk