[VPM] alternative to perl's Open?

[Peter Scott]

At 08:36 AM 9/7/2004, Carl B. Constantine wrote:
>A recent hack here at UVic caused no end of grief for system staff. We
>managed to shut the cracker down, but not before quite a bit of damage
>was done to 75 web pages.
>
>The exploit took advantage of a perl CGI script that used the Open
>command. The perl script is supposed to take a file, upload it to the
>site and run the file (used for testing people's course code). The
>cracker took advantage of that and included a standard pipe '|' in the
>command to wget and the rest is, as they say, history.
>
>So my question is, how do you code around that? If you need to do
>something like this, what should you do?

Known exploit, known solutions.

3-arg open (perldoc -f open) makes the most sense in this case.  Taint 
checking helps but I am rapidly becoming of the opinion that it is not 
the panacea it is generally made out to be.


-- 
Peter Scott
Pacific Systems Design Technologies
http://www.perldebugged.com/
*** New! *** http://www.perlmedic.com/