Why does the BSD version 1.10 of nc
disable the -e
option found in other, so-called insecure distributions when the same dangerous feature could be trivially achieved as follows even with the 'secure' version of nc
:
$ # Machine A
$ mkfifo pipe
$ nc -l 4000 <pipe | bash >pipe
$ # Machine B
$ nc MachineA 4000
Now, if I were to wrap-up the incantation on Machine A in a script (that, if passed a `-e' argument, effectively does the above), I have essentially introduced the 'gaping security hole' without having to step down to the Makefile and build level.
So, why go to the extent of #define
-ing GAPING_SECURITY_HOME
in netcat.c
?