Java and Memory Protections

Java and Memory Protections

Posted Nov 22, 2006 16:18 UTC (Wed) by NAR (subscriber, #1313)
In reply to: Java and Memory Protections by gouyou
Parent article: Virtual Machines and Memory Protections

The security problem won't anyway be fixed by PaX or SELinux. Any language providing an eval function will have this type of problem, just at a higher level.

Yes, consider this bash code:


X="/bin/r"
Y="m -f /"
Z=$X$Y
eval $Z


If the values of X and Y are not hardcoded, but come from the untrusted input, then it's a problem. That's why things like the -T option of perl got invented - I wonder if other languages/VMs have options like this.

Bye,NAR

---

(Log in to post comments)