Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Re: Potential setuid security hole #1624

Closed
p5pRT opened this issue Mar 30, 2000 · 2 comments
Closed

Re: Potential setuid security hole #1624

p5pRT opened this issue Mar 30, 2000 · 2 comments

Comments

@p5pRT
Copy link

p5pRT commented Mar 30, 2000

Migrated from rt.perl.org#2863 (status was 'resolved')

Searchable as RT2863$

@p5pRT
Copy link
Author

p5pRT commented Mar 30, 2000

From thospel@mail.dma.be

In article <27422.954388987@​chthon>,
  Tom Christiansen <tchrist@​chthon.perl.com> writes​:

Consider​:
- a setuid script without -T
^^^^^^^^^^^^^^^^^^^^^^^^

I think you're forgetting something.

You mean that the documentation says that setuid implies taint ?

Yes, I realise that. But when I tested, I saw that . remained in my @​INC.
But now when trying to prove this I can't, and going back in my history
I see that I did

chown 4755 test.pl

instead of

chmod 4755 test.pl

So I screwed up, and the report is nonsense.

Sorry :-(

@p5pRT
Copy link
Author

p5pRT commented Nov 28, 2003

From The RT System itself

'to quote the submitter \'So I screwed up, and the report is nonsense. \'\n'

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant