3 ms·

Am I missing something? Is lesspipe run as root? What could you execute via lesspipe that you couldn't from the command line?

by fleitz 12y ago

Moral_ 12y ago
>Is lesspipe run as root? Not normally >What could you execute via lesspipe that you couldn't from the command line? Nothing, but running lesspipe on some file shouldn't lead to remote shell being opened to some guy in Russia.
gear54rus 12y ago
> Ultimately, I think that there's an expectation that running less on a downloaded file won't lead to RCE When you use less, you do not expect any code to be executed, and this article shows how this might be the case (through unexpected invocations of other utilities which may have bugs in them). There are many ways to go from normal shell to root shell after that.
- andreasvc 12y ago
  And there is no need to get root to do serious damage, rm -r ~/* comes to mind.
- orblivion 12y ago
  So what's the point of root? To keep me out but let malicious people in?
- danielweber 12y ago
  There's not a firm list, but certain commands should always be safe to run against hostile input. If I type "make" on a project I downloaded, arbitrary stuff gets run. I accept that as part of make. If I sha256sum a hostile file, that should never lead to RCE.
  - tedunangst 12y ago
    If you open a PDF, that should never lead to RCE, but that's not the world we live in. Better for tools not to open PDFs when you don't expect that to happen.
    - danielweber 12y ago
      It depends what's hiding in the word "open." If I open a PDF in a full-featured reader, I'm slightly ill at ease. If I sha256sum it or wc it, I should be (read: ought to be, in any sane world) perfectly at ease. No matter how complicated the data structures in it, they shouldn't affect those programs.
      - tedunangst 12y ago
        As per the link, I'm talking about less "opening" a PDF by shelling out to pdftotext. "Hiding" is a good word for the behavior. :)
jlgaddis 12y ago
Imagine the case where someone sends you a malicious file and you open it with less.

Am I missing something? Is lesspipe run as root? What could you execute via lesspipe that you couldn't from the command line?

by fleitz 12y ago

Am I missing something? Is lesspipe run as root? What could you execute via lesspipe that you couldn't from the command line?

Moral_ 12y ago

>Is lesspipe run as root? Not normally >What could you execute via lesspipe that you couldn't from the command line? Nothing, but running lesspipe on some file shouldn't lead to remote shell being opened to some guy in Russia.

gear54rus 12y ago

> Ultimately, I think that there's an expectation that running less on a downloaded file won't lead to RCE When you use less, you do not expect any code to be executed, and this article shows how this might be the case (through unexpected invocations of other utilities which may have bugs in them). There are many ways to go from normal shell to root shell after that.

andreasvc 12y ago
And there is no need to get root to do serious damage, rm -r ~/* comes to mind.
orblivion 12y ago
So what's the point of root? To keep me out but let malicious people in?
danielweber 12y ago
There's not a firm list, but certain commands should always be safe to run against hostile input. If I type "make" on a project I downloaded, arbitrary stuff gets run. I accept that as part of make. If I sha256sum a hostile file, that should never lead to RCE.
- tedunangst 12y ago
  If you open a PDF, that should never lead to RCE, but that's not the world we live in. Better for tools not to open PDFs when you don't expect that to happen.
  - danielweber 12y ago
    It depends what's hiding in the word "open." If I open a PDF in a full-featured reader, I'm slightly ill at ease. If I sha256sum it or wc it, I should be (read: ought to be, in any sane world) perfectly at ease. No matter how complicated the data structures in it, they shouldn't affect those programs.
    - tedunangst 12y ago
      As per the link, I'm talking about less "opening" a PDF by shelling out to pdftotext. "Hiding" is a good word for the behavior. :)

jlgaddis 12y ago

Imagine the case where someone sends you a malicious file and you open it with less.