From owner-freebsd-bugs Sat Jan 26 9:40: 7 2002 Delivered-To: freebsd-bugs@hub.freebsd.org Received: from freefall.freebsd.org (freefall.FreeBSD.org [216.136.204.21]) by hub.freebsd.org (Postfix) with ESMTP id 1094C37B400 for ; Sat, 26 Jan 2002 09:40:03 -0800 (PST) Received: (from gnats@localhost) by freefall.freebsd.org (8.11.6/8.11.6) id g0QHe2107512; Sat, 26 Jan 2002 09:40:02 -0800 (PST) (envelope-from gnats) Date: Sat, 26 Jan 2002 09:40:02 -0800 (PST) Message-Id: <200201261740.g0QHe2107512@freefall.freebsd.org> To: freebsd-bugs@FreeBSD.org Cc: From: Giorgos Keramidas Subject: Re: misc/34270: man -k could be used to execute any command. Reply-To: Giorgos Keramidas Sender: owner-freebsd-bugs@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org The following reply was made to PR misc/34270; it has been noted by GNATS. From: Giorgos Keramidas To: "Crist J. Clark" Cc: bug-followup@freebsd.org Subject: Re: misc/34270: man -k could be used to execute any command. Date: Sat, 26 Jan 2002 19:30:47 +0200 Adding to my last post, since I forgot it. There are other ways to coerce man(1) into executing commands, but I don't know how paranoid we want to get. For instance try this command: $ PAGER="cat >/dev/null; echo T KERAMIDA DIE NOW K PLZ THX" man ls T KERAMIDA DIE NOW K PLZ THX Obviously the full power of a shell interpreter is a rather versatile thing to have in the PAGER environment variable, but do we really want this? I would suggest dropping everything after the first ';' character but quoting and other stuff can make this fail too. Any other ideas? -- Giorgos Keramidas . . . . . . . . . keramida@{ceid.upatras.gr,freebsd.org} FreeBSD Documentation Project . . . http://www.freebsd.org/docproj/ FreeBSD: The power to serve . . . . http://www.freebsd.org/ To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-bugs" in the body of the message