The Art of Software Security Assessment: Identifying and Preventing Software Vulnerabilities by John McDonald & Mark Down & Justin Schuh

Author:John McDonald & Mark Down & Justin Schuh [McDonald, John]
Language: eng
Format: epub
Publisher: Pearson Education
Published: 2006-11-19T23:00:00+00:00

* * *

Extraneous Delimiters

You know that standard library functions expect to see environment variables with the NAME=VALUE format. However, consider the case where you have a variable formatted like this:

NAME=LASTNAME=VALUE=ADDEDVALUE

Variations in how environment variables are formatted can be important, depending on how the algorithms responsible for fetching and storing values are implemented. Bugs of this nature have surfaced in the past in how the libc functions setenv()/unsetenv() work. The following is a quote from a post made by a security researcher named David Wagner (the post can be read in full at http://archives.neohapsis.com/archives/linux/lsap/2000-q3/0303.html):

Download

Copyright Disclaimer:
This site does not store any files on its server. We only index and link to content provided by other sites. Please contact the content providers to delete copyright contents if any and email us, we'll remove relevant links or contents immediately.