2008年1月9日 星期三

Warning of "system" and "pipe"

I chatted with my friend about some security issues days before. I had mentioned about the function call "system" and "pipe" shall be avoid in many cases. It's very simple idea, but as I know many programmers even do not know it's very dangerous.
Please NEVER NEVER NEVER use this function to important programs.
NEVER allow user to touch the args, or PATH.
Please~~~



#include <stdio.h>
#include <stdlib.h>
#include <string.h>
void fake_ls(int args,char **argv) {
char buf[50];
char *ptr=buf;
int i;
sprintf(buf,"ls");
for (i=1;i<args;i++) {
ptr = buf + strlen(buf);
sprintf(ptr," %s",argv[i]);
}
printf("The command you send is: '%s'\n",buf);
system(buf);
}
int main (int args,char **argv) {
printf("argv=%p\n",argv);
fake_ls(args,argv);
}


you can use the following argument to execute
extra command: "-al\;cat /etc/passwd"
It's very easy to see how terrible it is. :-)

沒有留言: