Re: .exrc file security risks

On Tue, 29 Apr 2003, Benjamin A. Okopnik wrote:

> tar xvzf evil.tgz
> 	fun_game/foo
> 	fun_game/bar	# This is a fun game - really!
> 	fun_game/gzot
> 	html/.exrc	# WHOOPS...
>
> Now, whenever Joe runs "vi" in the "html" subdirectory, he will be
> sourcing all the macros, etc. specified in "html/.exrc". I won't show
> any specific examples, but macros in "vi" can execute shell commands -
> and any keystroke can be tied to a macro.
>
> The autoloading of the per-directory .exrc files (and shell escape/write
> commands in them) can be disabled by invoking the "secure" command in
> "/etc/exrc". However, it can be cancelled with a "nosecure" line in a
> user's "~/.exrc" or even per-invocation:

There is no such option in in /usr/bin/vi on Solaris, and no support for
such a file.

The way to "lock this down" for the root user is to create a ~root/.exrc
file with the line "set noexrc" in it. Also remember to do /bin/su -
rather than just /bin/su (so that $EXINIT isn't passed alone).

-- 
Darren J Moffat