2 ms·
The posts you linked are just referring to the actual "feature", not another exploit. This feature is being able to define functions from enviroment variables,
by tokenizerrr 12y ago
The posts you linked are just referring to the actual "feature", not another exploit. This feature is being able to define functions from enviroment variables, and requires the attacker to be able to control both the enviroment variable name & value. If an attack can do this, they can also set LD_PRELOAD and a whole host of other nasty enviroment variables.