Environment Poisoning and login -p

Andrey Chernov ache at nagual.pp.ru
Thu Feb 26 15:09:31 PST 2004


On Thu, Feb 26, 2004 at 03:03:41PM -0800, Tim Kientzle wrote:
> Instead, I've decided to follow Jacques Vidrine's
> suggestion of using a whitelist of environment variables
> that are "known-safe."

Well, I agree with that too, if it will be big enough. At least don't
forget about putting LANG and LC_* there.

-- 
Andrey Chernov | http://ache.pp.ru/


More information about the freebsd-security mailing list