Re: .exrc file security risks

Hi Paul,

> I'm verifying the validity of a Solaris hardening guide and came across
> a recommendation to remove ".exrc" files. However, I can't find anything
> mentioning ".exrc" files  in any of the standard security guidelines I
> normally refer to (CISecurity and NSA).
>

.exrc files are used to configure the vi editor.  Everytime you start vi
this file is read.

> What, if any, are the risks associated with these files? (Or possibly
> the spelling ".exrc" is a typo and should be something else?)
>
.exrc can configure vi to (among many things) map keys to perform any vi
commands and (worse still from a security perspective) map keys to run
external commands.  So you have the situation where if a .exrc file is
compromised, a key could be maped to perform any command as the user running
vi...

cheers,
andrew