centos 6
shell weakness #6

4

Weakness Breakdown


Definition:

A shell weakness occurs when a program enables an attacker to execute unexpected commands on the operating system.

Warning code(s):

This causes a new program to execute and is difficult to use safely.

File Name:

gprolog-1.3.1/src/EnginePl/pl_config.c

Context:

The highlighted line of code below is the trigger point of this particular Centos 6 shell weakness.

   fprintf(g, "\n#else\n\n");
  for (i = 0; i < nb_stack; i++)
    fprintf(g, "extern long pl_def_%s_size;\n", stack[i].name);
  fprintf(g, "extern long pl_fixed_sizes;\n\n\n");
  fprintf(g, "extern InfStack pl_stk_tbl[];\n");
  fprintf(g, "\n#endif\n");


  fprintf(g, "\n\n   /*--- End Stack Generation ---*/\n\n");
}




/*-------------------------------------------------------------------------*
 * DETECT_SIGACTION                                                        *
 *                                                                         *
 *-------------------------------------------------------------------------*/
int
Detect_Sigaction(void)
{
  if (system("make try_sigaction 2>/dev/null 1>&2"))
    return 0;
  
  if (system("./try_sigaction") != 0)
    return 0;


  fprintf(fw_r, "\n#define HAVE_WORKING_SIGACTION 1\n");

  return 1;
}




/*-------------------------------------------------------------------------*
 * PL_FATAL_ERROR                                                          *
 *                                                                         *
 *-------------------------------------------------------------------------*/
void
Pl_Fatal_Error(char *format, ...)
{
  va_list arg_ptr;

  va_start(arg_ptr, format);
  vfprintf(stderr, format, arg_ptr);
  va_end(arg_ptr);

  fprintf(stderr, "\n"); 

The registered trademark Linux® is used pursuant to a sublicense from the Linux Foundation, the exclusive licensee of Linus Torvalds, owner of the mark on a world­wide basis.