[4332] in WWW Security List Archive
Re: Perl System Call HACKS
daemon@ATHENA.MIT.EDU (Adam Shostack)
Mon Feb 10 21:31:49 1997
From: Adam Shostack <adam@homeport.org>
In-Reply-To: <9702100746.ZM23110@sgiserv3.aws.waii.com> from Jeff Middleton at "Feb 10, 97 07:46:20 am"
To: jeffm@sgiserv3.aws.waii.com (Jeff Middleton)
Date: Mon, 10 Feb 1997 18:47:12 -0500 (EST)
Cc: www-security@ns2.rutgers.edu
Errors-To: owner-www-security@ns2.rutgers.edu
Don't use system, use exec.
Call 'sendmail -oi -t'.
(Oi ignores dots in the body of the message, -t takes all headers
from the data stream.)
Don't accept user data for *any* header variable.
Don't look for maliciousness, look for things you know are good.
Adam
Jeff Middleton wrote:
| Is there a FAQ or information giving some examples as to the way
| a perl script that executes sendmail via a PERL system call can
| be hacked?
|
| What strings are going to be malicious to the sendmail execution?
| Is there a work-around?
|
| You may eMail me directly at jeff.middleton@waii.com.
|
| Thanks in advance.
|
--
"It is seldom that liberty of any kind is lost all at once."
-Hume
