From 4c2d97d817a5ad4e89d982f4bd62e25307468de3 Mon Sep 17 00:00:00 2001
From: Ken Moffat <ken@linuxfromscratch.org>
Date: Thu, 18 Aug 2005 16:38:11 +0000
Subject: clarified the vulnerability with bzgrep

git-svn-id: http://svn.linuxfromscratch.org/LFS/trunk/BOOK@6705 4aa44e1e-78dd-0310-a6d2-fbcd4c07a689
---
 chapter06/bzip2.xml | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

(limited to 'chapter06/bzip2.xml')

diff --git a/chapter06/bzip2.xml b/chapter06/bzip2.xml
index 6b401650f..bf13936c0 100644
--- a/chapter06/bzip2.xml
+++ b/chapter06/bzip2.xml
@@ -36,8 +36,10 @@ GCC, Glibc, and Make</seg></seglistitem>
 
 <screen><userinput>patch -Np1 -i ../&bzip2-docs-patch;</userinput></screen>
 
-<para><command>Bzgrep</command> fails to sufficiently sanitise filenames passed
-to it. Apply the following to address this:</para>
+<para><command>Bzgrep</command> does not escape '|' and '&amp;' in filenames passed
+to it. This allows arbitrary commands to be executed with the privileges of the
+user running <command>bzgrep</command>. Apply the following to address this:
+</para>
 
 <screen><userinput>patch -Np1 -i ../&bzip2-bzgrep-patch;</userinput></screen>
 
-- 
cgit v1.2.3-54-g00ecf