From owner-freebsd-security  Tue Aug 11 16:39:34 1998
Return-Path: <owner-freebsd-security@FreeBSD.ORG>
Received: (from majordom@localhost)
          by hub.freebsd.org (8.8.8/8.8.8) id QAA28776
          for freebsd-security-outgoing; Tue, 11 Aug 1998 16:39:34 -0700 (PDT)
          (envelope-from owner-freebsd-security@FreeBSD.ORG)
Received: from khavrinen.lcs.mit.edu (khavrinen.lcs.mit.edu [18.24.4.193])
          by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id QAA28741
          for <freebsd-security@FreeBSD.ORG>; Tue, 11 Aug 1998 16:39:25 -0700 (PDT)
          (envelope-from wollman@khavrinen.lcs.mit.edu)
Received: (from wollman@localhost)
	by khavrinen.lcs.mit.edu (8.8.8/8.8.8) id TAA14075;
	Tue, 11 Aug 1998 19:38:57 -0400 (EDT)
	(envelope-from wollman)
Date: Tue, 11 Aug 1998 19:38:57 -0400 (EDT)
From: Garrett Wollman <wollman@khavrinen.lcs.mit.edu>
Message-Id: <199808112338.TAA14075@khavrinen.lcs.mit.edu>
To: Marc Slemko <marcs@znep.com>
Cc: "Mark J. Taylor" <mtaylor@cybernet.com>, freebsd-security@FreeBSD.ORG
Subject: Re: Possible security "risk" in ftp client
In-Reply-To: <Pine.GSO.4.00.9808111342100.19881-100000@redfish>
References: <XFMail.980811163822.mtaylor@cybernet.com>
	<Pine.GSO.4.00.9808111342100.19881-100000@redfish>
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.org

<<On Tue, 11 Aug 1998 13:44:12 -0700 (PDT), Marc Slemko <marcs@znep.com> said:

> Naw, that is worse since you can just use ps to grab it; the reason it is
> worse is because it tends to lead to people leaving it set when they
> aren't actually using the program.

I think there are good reasons (and this is one of them) to disable
the environment-dumping option of ps.  Unfortunately it is probably
too well-entrenched to kill.  I had totally forgotten about it until
this discussion began.

-GAWollman

--
Garrett A. Wollman   | O Siem / We are all family / O Siem / We're all the same
wollman@lcs.mit.edu  | O Siem / The fires of freedom 
Opinions not those of| Dance in the burning flame
MIT, LCS, CRS, or NSA|                     - Susan Aglukark and Chad Irschick

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe security" in the body of the message