Re: [Full-Disclosure] FAT32 input > output = null?

[Chris Palmer <chris@xxxxxxx>]

chris writes:

> This also works with the 2.4.24 Linux kernel (Slackware 9.1):

It's the shell, not the kernel. When you say "./foo > ./foo", the shell
interprets "> ./foo" FIRST and does something like open("foo", O_TRUNC |
O_CREAT). 

Take a look at any Unix shell document and the open(2) man page -- this
is old, known, documented behavior. It may violate the principle of
least surprise, but it's not a vulnerability in the proper sense.


-- 
Chris Palmer
Staff Technologist, Electronic Frontier Foundation
415 436 9333 x124 (desk), 415 305 5842 (cell)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html