Message-Id: <10633.118143@fatcity.com> From: "Allan Nelson" Date: Thu, 28 Sep 2000 08:19:47 -0500 Subject: Re: Unix Security for Unix Gurus This is a multi-part message in MIME format. ------=_NextPart_000_046B_01C02924.DD4015E0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Because a malicious person could put a program named ls for instance, in = your current directory. If you then executed ls you would pick up the = trojan and excute that instead of your expected command. Allan ----- Original Message -----=20 From: Sanjay Kumar=20 To: Multiple recipients of list ORACLE-L=20 Sent: Wednesday, September 27, 2000 8:30 PM Subject: Unix Security for Unix Gurus Hi, I was going thru the Unix documentation and came across the following. This is about setting PATH. The following is one of the suggestions = for setting efficient PATH. If security is not a concern, put the current working directory (.) = first in the path. However, including the current working directory in the path poses a = security risk that you might want to avoid, especially for superuser. My question is how does setting the current directory pose a security = threat? TIA Sanjay Kumar ------=_NextPart_000_046B_01C02924.DD4015E0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
Because a malicious person could put a = program=20 named ls for instance, in your current directory.  If you then = executed ls=20 you would pick up the trojan and excute that instead of your expected=20 command.
 
Allan
----- Original Message -----
From:=20 Sanjay=20 Kumar
To: Multiple recipients of list = ORACLE-L=20
Sent: Wednesday, September 27, = 2000 8:30=20 PM
Subject: Unix Security for Unix = Gurus

Hi,

I was going thru the Unix = documentation=20 and came across the following.

This is about setting PATH. = The=20 following is one of the suggestions for setting efficient = PATH.

If security = is not a=20 concern, put the current working directory (.) first in the=20 path.

However, including the current working = directory in=20 the path poses a security risk

that you might want to avoid, especially for = superuser.

My question is how does setting the current = directory pose a=20 security threat?

TIA

Sanjay=20 Kumar