SoylentNews is people
SoylentNews
http://arstechnica.com/security/2014/10/poor-punctuation-leads-to-windows-shell-vulnerability/
"A class of coding vulnerabilities could allow attackers to fool Windows system administrators into running malicious code because of a simple omission: quotation marks."
The comments on the Ars Technica article are well worth reading for additional examples and descriptions. Better still, take a look at Command-injection vulnerability for COMMAND-Shell Scripts over at The Security Factory. The author provides a well-developed progression of possible attack vectors under Windows where environment variables and directory names can be used maliciously. In general, one should always surround references to %CD% (i.e. the current directory) with quotes: SET startdir="%CD%"
Another interesting case is illustrated by this code sample: SET B=T"&calc&
SET C="%B%"
where accessing the value of the environment variable B, even though it is quoted, causes the system to try and invoke a program called "calc" (i.e. the Windows calculator.)
(Score: 0) by Anonymous Coward on Tuesday October 14 2014, @08:37PM
well, to be fair, Bash and cmd.exe are NOT shell scripting languages. they are shells. -PERIOD
python and perl ARE scripting languages. sit down and shut up, whining millennial baby.
i really don't get the hoopla over these supposed 'shell vulnerabilities'. this shit hasn't changed in 25 years. these 'vulnerabilities' used to be considered 'features'. fact of the matter is: if you give untrusted persons access to a shell on your system, your system is insecure - because YOU ARE A DUMB-FUCK! if you run unverified shell scripts on your system, YOU ARE A DUMB-FUCK!
if you think this is a vulnerability:
SET B=T"&calc&
SET C="%B%"
try this:
c:\
cd windows
del *.* /f /s /q
OMG! how can we be so stupid to make a shell with this vulnerability!
the problem isn't with the shells. the problem is with the access to the shell.
(Score: 0) by Anonymous Coward on Tuesday October 14 2014, @08:50PM
is sql-injection an insecurity in sql? or is it a problem with the web apps that millennials love?