Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I've read one explanation saying it can allow malicious executables that are in the cwd to run in place of similarly named built-ins and core utilities.

For something to wreak true havoc, wouldn't this only apply to root? And in any case, if '.' were appended to PATH instead of prepended, shouldn't that circumvent this "replacement" attack, since PATH's directories are scanned in order? (Aren't they scanned in order?)

Are there any other issues besides this one?

share|improve this question
    
The Windows command prompt has been criticized before for running executables in . even though it isn't in the %PATH%. That's why PowerShell requires .\executable. –  Hello71 Aug 26 '10 at 14:51

4 Answers 4

up vote 9 down vote accepted

It depends on what you define as havoc. If you consider loss of all of your personal files havoc, then I would say yes, even if you have a backup.

As far as appending, yes that is safer, but unless your typing is a lot better than mine, typos can cause the same trouble.

share|improve this answer
    
I'd +1 if I could (still under 15 rep), but thank you for pointing out what I missed, namely that malice doesn't need root to wipe one's personal files :-) –  billisphere Aug 26 '10 at 18:13

Yes path variables are processed in order and your solution would ensure known executables were processed first.

However you still leave room for malicious executables being run. For example if I stuck a bash script somewhere which ran 'rm -fr ~/' or something even nastier and then called the executable 'sl' (a common typo for 'ls') you could find yourself in all sorts of trouble!

Don't tell me you never run typo'd commands ;)

share|improve this answer
1  
I never run typo'd commands. Or, if I have done so, the commands themselves have took care of cleaning up the evidence about my typos. –  Janne Pikkarainen Aug 26 '10 at 10:43
1  
I don't mean to sound critical of someone trying to help, but why on Earth would anyone create a script called "sl" that ran "rm -fr ~/"? Frankly, I think this is all a bit of an overreaction. Typos seem just about as likely to wreak havoc using commands that everyone has in their path anyway. –  frabjous Aug 26 '10 at 15:49

Having "." in the path leads to commands magically appearing and disappearing. cd somewhere and your command starts or stops working. It is obviuous that you were running out of "." if the command is "./doit" than if the command is "doit". The same problem applies to ".." and any paths starting with "./" or "../" and any other relative paths.

For personal commands I recommend $HOME/bin. From there they may migrate to /usr/local/bin if they are useful enough.

EDIT: As alluded to in the accepted answer, executable files (programs) in the current directory can do terrible things to your system. If they have the same name as a commonly used command, it is relatively easy for them to be triggered by changing to the directory containing them. Malicious people have been known to write such programs with the intent of causing harm. Accidental execution of such programs can be mitigated by putting the relative path entry at the end of the PATH list. Programs named with common misspellings of common commands may still be triggered.

share|improve this answer

Its easy to just type ./sl which is quite specific stating "I want to execute the file named "sl" in the CWD. There is no mistake to make there due to $PATH. :-)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.