Full Disclosure mailing list archives
Re: getenv("=A") works (no particular vulnerability)
From: Andy Bach <afbach () gmail com>
Date: Fri, 4 Feb 2022 14:41:25 -0600
bash, for one, doesn't allow = to start an env var name On Fri, Feb 4, 2022 at 2:25 PM Askar Safin via Fulldisclosure < fulldisclosure () seclists org> wrote:
TL;DR: this mail doesn't contain any actual vulnerability, just an idea. Consider this C code for Linux and glibc: --------- #define _GNU_SOURCE 1 #include <stdio.h> #include <stdlib.h> #include <unistd.h> char *new_env[] = {"=A=B", 0}; int main () { environ = new_env; printf("%s\n", getenv("=A")); // prints "B" return 0; } --------- This code prints "B". I. e. glibc allows variables starting with "=". It is quite possible such behavior can lead to various vulnerabilities. It is possible this list is inappropriate for such message. If so, please, say, where I should post such message next time. == Askar Safin http://safinaskar.com https://sr.ht/~safinaskar https://github.com/safinaskar _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
-- a Andy Bach, afbach () gmail com 608 658-1890 cell 608 261-5738 wk _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
Current thread:
- getenv("=A") works (no particular vulnerability) Askar Safin via Fulldisclosure (Feb 04)
- Re: getenv("=A") works (no particular vulnerability) Andy Bach (Feb 06)
- Re: getenv("=A") works (no particular vulnerability) bo0od via Fulldisclosure (Feb 06)