4 ms·
Confining the parser to a namespace as in your second paragraph should be a sufficient solution, because it is already a well-known fact that allowing completel
by nhaehnle 12y ago
Confining the parser to a namespace as in your second paragraph should be a sufficient solution, because it is already a well-known fact that allowing completely arbitrary control of the environment to a potential attacker is a bad idea, and existing software is written to account for that fact by restricting which environment variables can be set.
In the CGI case, for example, the environment variables in question are prefixed by HTTP_.
The problem is that any fix for this bug that makes the security crowd perfectly happy is necessarily going to break compatibility for the (probably very few) people who actually use this feature.
- kazinator 12y agoHowever, a flaw in some software (failure to properly restrict environment variables) is amplified by this feature of the shell; it gives an attacker an instant way to do harm. Whereas without this feature, attackers have to find some other ways by which environment variable contents can lead to an exploit. E.g. smuggle a rogue shared library onto the system somehow, then LD_PRELOAD it or whatever.