[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 28 Jan 2009 09:02:45 -0500 (EST)
From: "Steven M. Christey" <coley@...us.mitre.org>
To: oss-security@...ts.openwall.com
Subject: Re: update on CVE-2008-5718
On Wed, 28 Jan 2009, Thomas Biege wrote:
> New patch attached, the old one was missing spaces.
> Hope the blacklist is complete now...
Would a "-" character allow an argument injection attack by inserting
dangerous command-line switches? Things like being able to add a "-rf" as
an argument to the rm command...
I assume there's something undesirable about quoting everything unless
it's alphanumeric?
- Steve
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Powered by Openwall GNU/*/Linux -
Powered by OpenVZ
