From: Harry Ohlsen <harryo@...>
Date: 2003-11-25T07:18:10+09:00
Subject: Re: Message "Insecure world writable dir ..."

> Hi Matz,
> 
> Could you (or someone else) explain what the rationale behind this 
> message is?  What sort of thing is it meant to prevent?  I get it all 
> the time because I have some odd permissions on some of my directories.  
> I don't see it as an issue, because the security concerns are taken care 
> of in other ways.  It seems odd to me that File.popen() (and '`' and 
> 'system') would complain about a world-writeable-directory, or even do 
> any security checks, unless you explicitly set some variable.
> 
> Am I missing something obvious?

IANM, but ...

Imagine that, say, /export/home is world writeable.  I could make a copy of someone's home directory, say "fred" and change some files in there (eg a script or executable).  If I then move "fred" to "fred.original" and replace it with my modified version, then Fred might run my trojan script/executable.

This allows me to get something done and have it look like Fred did it.  This could be, for example, sending an e-mail, or pretty much anything else I want.  Equally, I might be interested in doing something using Fred's permissions that I might not be allowed to do with my own.

While this is fun, it's not a good thing :-).

Cheers,

Harry O.