oss-security - Re: Abusing TZ for fun (and little profit)

Message-ID: <20141214162028.GA5669@jwilk.net>
Date: Sun, 14 Dec 2014 17:20:28 +0100
From: Jakub Wilk <jwilk@...lk.net>
To: oss-security@...ts.openwall.com
Subject: Re: Abusing TZ for fun (and little profit)

* Jakub Wilk <jwilk@...lk.net>, 2014-10-16, 00:35:
>By default, sudo preserves the TZ variable[1] from user's environment. 
>This is a bad idea on glibc systems, where TZ can be abused to trick 
>the program to read an arbitrary file.

Oh, and the glibc's tzfile parser is apparently not very robust:
https://bugs.debian.org/772705

-- 
Jakub Wilk

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.