Multi-layer problems…

• The code is bad, but the problem isn’t just the code

• It’s the compiled code, running setuid, owned by 0

• Even that might not be so bad, but we’re on AIX

• Who is in charge of predicting where/how code will run?

char infile[80], username[40], mail_file[40], current_user[40], tmpstr[40];

/* snip of some intervening code that doesn't pertain to this example

... blah, blah, blah ... mumble mumble mumble ...

*/

strcpy(current_user, getenv("LOGNAME"));

Previous slide

Next slide

Back to first slide

View graphic version