Re: [xml] security issue.

On Fri, Jul 19, 2002 at 03:21:10PM +0530, laavanya wrote:

 The problem of the environment variables of an user being visible to the
other users, without the user having to hack into the environment still
exists in Solaris. The /usr/ucb/ps command helps here.

 Executing "/usr/ucb/ps uxgaeww" lists out all the environment variables
and their values used by all the users currently logged in to the system,
including root's.

This /usr/ucb/ps call is present for compatibility with BSD.

 So, now as we can see the env through the /usr/ucb/ps command, the
FTP username and password of a user is visible to all. Isn't this an issue ?

  Those two environement variables are somewhat standard, they 
are used by libwww too and a few other apps. Now if you can't 
trust environemnt variables, don't use them to store passwords.
And if you can't trust your OS about preserving specific details
of your environemnt private, IMHO it's time to switch to another OS !

  Again I don't see why this problem is libxml2 related !
You don't have to use the environment variables, there are internal
ways to set those values. It's just the common way to do this.


Daniel Veillard      | Red Hat Network
veillard redhat com  | libxml GNOME XML XSLT toolkit | Rpmfind RPM search engine

[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]