\"special\" shells a security hole?

[wcs at ho95e.UUCP]

There's been a discussion on providing restricted environments without
using chroot, and how to deal with shell escapes from editors, BBSs, more,...

In article <3037 at gitpyr.gatech.EDU> robert at gitpyr.UUCP (Robert Viduya) writes:
>Actually, you can "disable" shell escapes from more(1) or ex(1) or any
>other program that follows conventions by simply setting the SHELL
>environment variable to a null program before executing the program.
>.....
>Watch out for programs that allow shell escapes but ignore SHELL, though.
>I don't know of any that do, but that doesn't mean they don't exist.
>They're anti-social anyway.

The "system(3)" subroutine call does this, at least on V7, 4.1BSD, and
System V Release 0 and 2.  A lot of commands use it, including /bin/mail.
Aside from being anti-social (4.*BSD and SVR2 are old enough to know better),
it can also be a source of bugs and/or security risks.
-- 
# Bill Stewart, AT&T Bell Labs 2G-202, Holmdel NJ 1-201-949-0705 ihnp4!ho95c!wcs