> Greetings all,
> I have been trying to get a C program to do things like mount
> and umount cd's. In desperation I gave up trying to make other
> people's programs work and set out on my own. It was pretty
> easy after all. You can make this little program do anything you want
> by changing the command inside the quotes in this line:
> char *command = ("enter any unix command");
>
> This is the C program to shutdown the system in 1 minute
[code and instructions omitted]
> I believe this should be immune to the pervasive buffer
> overflow problems because there is no input. I hope
> somebody finds it useful.
It is useful, unfortunately you don't have to change *command to make it do
what you want. Any user could make it run any command even once it's been
compiled!
You do not, and I mean *absolutely* not, want to call "system" in a setuid
program. As supplied, any user with '.' in their path can simply create
their own program called "shutdown" and that would be run instead. Even if
you put in the complete path to "/usr/sbin/shutdown" in *command the user
could "setenv IFS /" [see sh(1) for information about "IFS"] and then create
a program called "usr" instead.
Ray.
NB: FreeBSD doesn't seem vulnerable to IFS hacks, although I haven't quite
figured out how it prevents it yet.
--
Ray Bellis, MA(Oxon) - Technical Director - Oxford CommUnity Internet plc
Windsor House, 12 High Street, Kidlington, OXFORD OX5 2PJ UK
Telephone: +44-1865-856000 Fax: +44-1865-856001
Email: ray.bellis_at_community.net.uk URL: http://www.community.co.uk/
Received on Wed Dec 02 1998 - 23:30:35 NZDT