Re: Re: Gaim festival plugin exploit

[merlyn () stonehenge com (Randal L. Schwartz)]

> > > > > "Dale" == Dale Harris <rodmur () maybe org> writes:

Dale> So let me guess  open FEST "|..." uses popen(), right?

No, it doesn't.  It uses its own code, which looks at the string
to see if there are shell constructs, and if not, avoids the
shell by parsing whitespace and args on its own.


-- 
Randal L. Schwartz - Stonehenge Consulting Services, Inc. - +1 503 777 0095
<merlyn () stonehenge com> <URL:http://www.stonehenge.com/merlyn/>
Perl/Unix/security consulting, Technical writing, Comedy, etc. etc.
See PerlTraining.Stonehenge.com for onsite and open-enrollment Perl training!

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html