From owner-freebsd-security@FreeBSD.ORG  Thu Feb 26 15:09:31 2004
Return-Path: <owner-freebsd-security@FreeBSD.ORG>
Delivered-To: freebsd-security@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP
	id 7B3C116A4CE; Thu, 26 Feb 2004 15:09:31 -0800 (PST)
Received: from nagual.pp.ru (pobrecita.freebsd.ru [194.87.13.42])
	by mx1.FreeBSD.org (Postfix) with ESMTP
	id 9FDD743D2F; Thu, 26 Feb 2004 15:09:30 -0800 (PST)
	(envelope-from ache@pobrecita.freebsd.ru)
Received: from pobrecita.freebsd.ru (ache@localhost [127.0.0.1])
	by nagual.pp.ru (8.12.11/8.12.11) with ESMTP id i1QN9NDM074219;
	Fri, 27 Feb 2004 02:09:23 +0300 (MSK)
	(envelope-from ache@pobrecita.freebsd.ru)
Received: (from ache@localhost)
	by pobrecita.freebsd.ru (8.12.11/8.12.11/Submit) id i1QN9NtM074218;
	Fri, 27 Feb 2004 02:09:23 +0300 (MSK)
	(envelope-from ache)
Date: Fri, 27 Feb 2004 02:09:22 +0300
From: Andrey Chernov <ache@nagual.pp.ru>
To: kientzle@acm.org
Message-ID: <20040226230921.GD73252@nagual.pp.ru>
Mail-Followup-To: Andrey Chernov <ache@nagual.pp.ru>,
	kientzle@acm.org, freebsd-security@FreeBSD.ORG, das@FreeBSD.ORG
References: <403CEF67.5040004@kientzle.com>
	<20040226225149.GB73252@nagual.pp.ru> <403E7B4D.8030803@kientzle.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <403E7B4D.8030803@kientzle.com>
User-Agent: Mutt/1.5.6i
X-AntiVirus: checked by AntiVir Milter 1.0.6; AVE 6.24.0.5; VDF 6.24.0.20
cc: freebsd-security@FreeBSD.ORG
cc: das@FreeBSD.ORG
Subject: Re: Environment Poisoning and login -p
X-BeenThere: freebsd-security@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Security issues [members-only posting]
	<freebsd-security.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>,
	<mailto:freebsd-security-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-security>
List-Post: <mailto:freebsd-security@freebsd.org>
List-Help: <mailto:freebsd-security-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>,
	<mailto:freebsd-security-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 26 Feb 2004 23:09:31 -0000

On Thu, Feb 26, 2004 at 03:03:41PM -0800, Tim Kientzle wrote:
> Instead, I've decided to follow Jacques Vidrine's
> suggestion of using a whitelist of environment variables
> that are "known-safe."

Well, I agree with that too, if it will be big enough. At least don't
forget about putting LANG and LC_* there.

-- 
Andrey Chernov | http://ache.pp.ru/