3 ms·
OpenSSL – C_rehash script allows command injection
- assttoasstmgr 4y agoIsn't this a nothing-burger? c_rehash does not run setuid root. Is there an example or threat of a practical exploit that I am overlooking here or is this just academic nitpicking?
- scintill76 4y ago“This script is distributed by some operating systems in a manner where it is automatically executed” — probably executed as root, right?
- hulitu 4y agoThen the bug is in the OS. Did you know that rm can destroy your system ?