> We wanted to inform all major *nix distributions via our responsible > disclosure policy about this problem before posting it
I'm not sure how to put it mildly, but I think you might have been scooped on this some 1-2 decades ago... Off the top of my head, there's a rant about this behavior in "The Unix-Haters Handbook", and there are several highly detailed articles by David Wheeler published over the years (e.g., http://www.dwheeler.com/essays/filenames-in-shell.html). Yup, it's a counterintuitive behavior that leads to security problems. The odds of changing the semantics at this point are very slim. Other operating systems have their own idiosyncrasies in this area - for example, Windows it not a lot better with parameter splitting and special filenames. /mz _______________________________________________ Sent through the Full Disclosure mailing list http://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
