[<prev] [next>] [day] [month] [year] [list]
Message-ID: <20110828075509.GA4267@albatros>
Date: Sun, 28 Aug 2011 11:55:10 +0400
From: Vasiliy Kulikov <segoon@...nwall.com>
To: owl-dev@...ts.openwall.com
Subject: procps hardening
Solar,
Our procps utils don't filter control characters:
$ cat a.c
#include <sys/prctl.h>
#include <unistd.h>
int main(int argc, char *argv[])
{ prctl(PR_SET_NAME, argv[1]); argv[0] = argv[1]; sleep(1000); return 0; }
$ gcc -Wall a.c -o a
$ ./a 'smth
> 1 init'
("smth" \n "1" SP SP SP SP "init")
(another tty)
$ pgrep -l smth
4299 smth
1 init
However, it seems ps filters them:
# ps a | grep smth
4299 pts/2 S+ 0:00 ./a smth?1 init
IMO all procps utils should filter ctrls.
--
Vasiliy
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
