r6705 - trunk/BOOK/chapter06

ken at linuxfromscratch.org ken at linuxfromscratch.org
Thu Aug 18 09:38:12 PDT 2005


Author: ken
Date: 2005-08-18 10:38:11 -0600 (Thu, 18 Aug 2005)
New Revision: 6705

Modified:
   trunk/BOOK/chapter06/bzip2.xml
Log:
clarified the vulnerability with bzgrep

Modified: trunk/BOOK/chapter06/bzip2.xml
===================================================================
--- trunk/BOOK/chapter06/bzip2.xml	2005-08-18 15:41:20 UTC (rev 6704)
+++ trunk/BOOK/chapter06/bzip2.xml	2005-08-18 16:38:11 UTC (rev 6705)
@@ -36,8 +36,10 @@
 
 <screen><userinput>patch -Np1 -i ../&bzip2-docs-patch;</userinput></screen>
 
-<para><command>Bzgrep</command> fails to sufficiently sanitise filenames passed
-to it. Apply the following to address this:</para>
+<para><command>Bzgrep</command> does not escape '|' and '&' in filenames passed
+to it. This allows arbitrary commands to be executed with the privileges of the
+user running <command>bzgrep</command>. Apply the following to address this:
+</para>
 
 <screen><userinput>patch -Np1 -i ../&bzip2-bzgrep-patch;</userinput></screen>
 




More information about the lfs-book mailing list