Date: Sun, 14 Dec 2014 17:20:28 +0100 From: Jakub Wilk <jwilk@...lk.net> To: oss-security@...ts.openwall.com Subject: Re: Abusing TZ for fun (and little profit) * Jakub Wilk <jwilk@...lk.net>, 2014-10-16, 00:35: >By default, sudo preserves the TZ variable from user's environment. >This is a bad idea on glibc systems, where TZ can be abused to trick >the program to read an arbitrary file. Oh, and the glibc's tzfile parser is apparently not very robust: https://bugs.debian.org/772705 -- Jakub Wilk
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.