[sudo-users] Sudosh version 1.3.4 is now available
Doug Hanks
dhanks at gmail.com
Mon Oct 25 01:33:36 EDT 2004
Sudosh version 1.3.4 is now available.
http://freshmeat.net/projects/sudosh/
http://sourceforge.net/projects/sudosh/
(freshmeat is slow on file releases; sf is always current)
Major changes since Sudosh version 1.3.2:
o Corrected major security hole in the SHELL environment variable.
I correctly set the (char *) shell that was cross-referenced with
/etc/shells, but during the prepchild I was still using the old
SHELL environment variable.
I went a further step and used the execle() syscall with an empty
(char *) so that shell doesn't inherit any environment variables
from the calling user.
--
- Doug Hanks = dhanks(at)gmail(dot)com
More information about the sudo-users
mailing list