5 ms·
> Ultimately, I think that there's an expectation that running less on a downloaded file won't lead to RCE When you use less, you do not expect any code to be
by gear54rus 12y ago
> Ultimately, I think that there's an expectation that running less on a
downloaded file won't lead to RCE
When you use less, you do not expect any code to be executed, and this article shows how this might be the case (through unexpected invocations of other utilities which may have bugs in them).
There are many ways to go from normal shell to root shell after that.
- andreasvc 12y agoAnd there is no need to get root to do serious damage, rm -r ~/* comes to mind.
- orblivion 12y agoSo what's the point of root? To keep me out but let malicious people in?
- danielweber 12y agoThere's not a firm list, but certain commands should always be safe to run against hostile input. If I type "make" on a project I downloaded, arbitrary stuff gets run. I accept that as part of make. If I sha256sum a hostile file, that should never lead to RCE.
- tedunangst 12y agoIf you open a PDF, that should never lead to RCE, but that's not the world we live in. Better for tools not to open PDFs when you don't expect that to happen.
- danielweber 12y agoIt depends what's hiding in the word "open." If I open a PDF in a full-featured reader, I'm slightly ill at ease. If I sha256sum it or wc it, I should be (read: ought to be, in any sane world) perfectly at ease. No matter how complicated the data structures in it, they shouldn't affect those programs.
- tedunangst 12y agoAs per the link, I'm talking about less "opening" a PDF by shelling out to pdftotext. "Hiding" is a good word for the behavior. :)