5 ms·

Which OS' are compiling `nc` with `-DGAPING_SECURITY_HOLE` ?

• cjhanks 7y ago
  Jeez, what's with the down votes? Look at the netcat documentation, that's what the configuration option for "-e" is called. https://ps.uci.edu/~franklin/doc/netcat.html https://ps.uci.edu/~franklin/doc/netcat.html https://stackoverflow.com/questions/15351646/how-to-re-compile-netcat-with-options https://stackoverflow.com/questions/15351646/how-to-re-compi...
  • jontro 7y ago
    How is it related to the vim vulnerability?
    • cjhanks 7y ago
      That was the proof-of-concept they used.
• nebulous1 7y ago
  The -e option is pretty useful for security researchers, so it would be common enough for people trying the POC
• deathanatos 7y ago
  What's the gaping security hole there? My interpretation of the documentation is that -e PROG execs PROG with stdin/stdout set to the accepted socket. (I mean, it's possible to write a program that, if it receives any input on stdin, would rm -rf everything. But the error seems with the combination of the program and -e, and not -e? That is, -e isn't inherently dangerous? Or do we just not trust ourselves that much?)
  • cyphar 7y ago
    -DGAPING_SECURITY_HOLE is how you have to compile nc in order to enable "-e" support. The gaping security hole is that it is literally RCE-as-a-feature -- yes, it's not as bad as "pass any text you get over this socket to a shell session" but it's still pretty bad.
    • FDSGSG 7y ago
      There is no security hole, -e isn't pretty bad.
      • Bjartr 7y ago
        He's not being facetious by saying -DGAPING_SECURITY_HOLE, that is literally the flag you need to set when compiling nc to use the -e flag. https://android.googlesource.com/platform/external/netcat/+/refs/tags/android-2.2.3_r1/netcat.c#570 https://android.googlesource.com/platform/external/netcat/+/...
        • FDSGSG 7y ago
          I know that's the flag you need to set, but despite the name setting the flag does not introduce any kind of a security hole.