From owner-freebsd-security Mon Oct 30 17:30:57 2000 Delivered-To: freebsd-security@freebsd.org Received: from citusc17.usc.edu (citusc17.usc.edu [128.125.38.177]) by hub.freebsd.org (Postfix) with ESMTP id 37A8B37B479 for ; Mon, 30 Oct 2000 17:30:55 -0800 (PST) Received: (from kris@localhost) by citusc17.usc.edu (8.11.1/8.11.1) id e9V1Wwd15406; Mon, 30 Oct 2000 17:32:58 -0800 (PST) (envelope-from kris) Date: Mon, 30 Oct 2000 17:32:58 -0800 From: Kris Kennaway To: James Wyatt Cc: Cy Schubert - ITSD Open Systems Group , freebsd-security@FreeBSD.ORG Subject: Re: tcsh: unsafe tempfile in << redirects (fwd) Message-ID: <20001030173258.B15245@citusc17.usc.edu> References: <20001030153129.A15198@citusc17.usc.edu> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-md5; protocol="application/pgp-signature"; boundary="ZfOjI3PrQbgiZnxM" Content-Disposition: inline User-Agent: Mutt/1.2.5i In-Reply-To: ; from jwyatt@rwsystems.net on Mon, Oct 30, 2000 at 06:59:12PM -0600 Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org --ZfOjI3PrQbgiZnxM Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Mon, Oct 30, 2000 at 06:59:12PM -0600, James Wyatt wrote: > On Mon, 30 Oct 2000, Kris Kennaway wrote: > > On Mon, Oct 30, 2000 at 01:26:41PM -0800, Cy Schubert - ITSD Open Syste= ms Group wrote: > > > Our tcsh appears vulnerable. So is the 44bsd-csh port. > >=20 > > Yep, stupid braindead $*&^*# shells... >=20 > Was that comment *really* necessary? I use bash myself, but have enough > users using tcsh (and ksh, etc) that I care about them too. Of course, > some folks consider Emacs their shell... Most are just glad to have > something besides command.com to work with. (^_^) I don't care about features of the shell, I care about braindead coding practises like thinking you don't have to worry that your filename is predictable and is created insecurely. Kris --ZfOjI3PrQbgiZnxM Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.4 (FreeBSD) Comment: For info see http://www.gnupg.org iEYEARECAAYFAjn+IUkACgkQWry0BWjoQKXV0wCfSkQOwkVGL7VxdvyvkwsWJyKB 4rUAoO2FRCoib0lE+VxCTJOXdIM7830r =lTWz -----END PGP SIGNATURE----- --ZfOjI3PrQbgiZnxM-- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message