Comment 15 for bug 610125

Revision history for this message
Kees Cook (kees) wrote :

This still needs fixing, unfortunately. "env" is called without a fully qualified path, which means a malicious PATH can still cause problems. (Again, only in the case of having pam_motd added to non-default pam service configs that are local setuid applications.)