[LUG] Linux wildcard poison vulnerability

[Martijn Grooten <martijn@xxxxxxxxxxxxxxxxxx>]

This is interesting, and could potentially have serious consequences -
even if the attack vector is probably rather small.

http://www.theregister.co.uk/2014/07/03/unix_wildcard_vuln_lets_hackers_modify_shell_scripts/

The idea is that many Linux (and Unix) commands are invoked using
wildcards:

  command *

which takes all files in the current directory as arguments. Everyone
who's ever worked with the command line will know this. Just like they
know that options are given to the command as arguments that start with
a dash.

But what if the current directory contains two files: 'foo.txt' and
'-al'. Then a command like

  ls *

is interpreted as

  ls foo.txt -al

in other words, as the command 'ls' with options 'al' on the file
foo.txt. And indeed, rather than a simple list of all the files in the
current directory you get a 'list' consisting solely of foo.txt, but
with its attributes shown.

Martijn.




-- 
The Mailing List for the Devon & Cornwall LUG
http://mailman.dclug.org.uk/listinfo/list
FAQ: http://www.dcglug.org.uk/listfaq