From owner-freebsd-security Mon Oct 30 20: 2:33 2000 Delivered-To: freebsd-security@freebsd.org Received: from citusc17.usc.edu (citusc17.usc.edu [128.125.38.177]) by hub.freebsd.org (Postfix) with ESMTP id C7D5237B479 for ; Mon, 30 Oct 2000 20:02:29 -0800 (PST) Received: (from kris@localhost) by citusc17.usc.edu (8.11.1/8.11.1) id e9V44X016040; Mon, 30 Oct 2000 20:04:33 -0800 (PST) (envelope-from kris) Date: Mon, 30 Oct 2000 20:04:33 -0800 From: Kris Kennaway To: James Wyatt Cc: Cy Schubert - ITSD Open Systems Group , freebsd-security@FreeBSD.ORG Subject: Re: tcsh: unsafe tempfile in << redirects (fwd) Message-ID: <20001030200433.B16017@citusc17.usc.edu> References: <20001030173258.B15245@citusc17.usc.edu> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-md5; protocol="application/pgp-signature"; boundary="eAbsdosE1cNLO4uF" Content-Disposition: inline User-Agent: Mutt/1.2.5i In-Reply-To: ; from jwyatt@rwsystems.net on Mon, Oct 30, 2000 at 08:59:32PM -0600 Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org --eAbsdosE1cNLO4uF Content-Type: text/plain; charset=us-ascii Content-Disposition: inline On Mon, Oct 30, 2000 at 08:59:32PM -0600, James Wyatt wrote: > I can see your (and David G. Andersen's) point about this and agree. (Your > answers to my response were much clearer than the original comment.) This > also argues against allowing suid shell-scripts anywhere. Are there any > shells that are audited for correctness or security? (does sh qualify?) Is > using Perl for system scripts really more secure than shell scripts? - Jy@ Perl at least tries to taint external input, etc. I don't know of any POSIX-like shells which have this feature. Kris --eAbsdosE1cNLO4uF Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.4 (FreeBSD) Comment: For info see http://www.gnupg.org iEUEARECAAYFAjn+RNAACgkQWry0BWjoQKXYYwCXdCpw8iMFfhhut3fjwca0ygTm FwCgjJuPc94tojzoxkhgAiSXZJ4OxQY= =/wyh -----END PGP SIGNATURE----- --eAbsdosE1cNLO4uF-- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message