Path: utzoo!utgpu!news-server.csri.toronto.edu!cs.utexas.edu!swrinde!ucsd!sdd.hp.com!uakari.primate.wisc.edu!aplcen!haven!adm!cmcl2!kramden.acf.nyu.edu!brnstnd
From: brnstnd@kramden.acf.nyu.edu (Dan Bernstein)
Newsgroups: comp.unix.shell
Subject: Re: Beware xargs security holes
Message-ID: <4252:Oct2321:25:3090@kramden.acf.nyu.edu>
Date: 23 Oct 90 21:25:30 GMT
References: <tim.656101080@ggumby> <3940@awdprime.UUCP> <1890@necisa.ho.necisa.oz>
Organization: IR
Lines: 15

In article <1890@necisa.ho.necisa.oz> boyd@necisa.ho.necisa.oz (Boyd Roberts) writes:
> In article <3940@awdprime.UUCP> tif@doorstop.austin.ibm.com (Paul Chamberlain) writes:
> >In any case, I've yet to see how "a malicious user [could]
> >remove every file on the system."
> A malicious user may be able to embed newlines in filenames,
> but that's not going to trash the _whole_ file-system.

Oh? Each filename he sets up can remove dozens of other files. There are
only so many files in the entire system.

> If someone did change xargs(1) to use system(3) it's obviously been broken.

Agreed.

---Dan