Environment Poisoning and login -p
Andrey Chernov
ache at nagual.pp.ru
Thu Feb 26 15:09:31 PST 2004
On Thu, Feb 26, 2004 at 03:03:41PM -0800, Tim Kientzle wrote:
> Instead, I've decided to follow Jacques Vidrine's
> suggestion of using a whitelist of environment variables
> that are "known-safe."
Well, I agree with that too, if it will be big enough. At least don't
forget about putting LANG and LC_* there.
--
Andrey Chernov | http://ache.pp.ru/
More information about the freebsd-security
mailing list