4 ms·
Perl backticks and system() delegate commands to the system shell, normally sh. On many systems, sh is simply bash in compatibility mode. That's how the attacke
by ordinary 12y ago
Perl backticks and system() delegate commands to the system shell, normally sh. On many systems, sh is simply bash in compatibility mode. That's how the attacker gets at the vulnerability.
- owenfi 12y agoThanks. Suspected as much, but still a bit petrified that the shell var/func passed through perl to the backtick-shell.
- mutation 12y agosystem() delegates to shell only in the case of one argument given to system().
- justincormack 12y agoNice that "compatibility mode" does not bother to disable this technically non compatible behaviour...