Mailing-List: contact zsh-workers-help@zsh.org; run by ezmlm
Precedence: bulk
X-No-Archive: yes
List-Id: Zsh Workers List <zsh-workers.zsh.org>
List-Post: <mailto:zsh-workers@zsh.org>
List-Help: <mailto:zsh-workers-help@zsh.org>
X-Spam-Checker-Version: SpamAssassin 3.4.1 (2015-04-28) on f.primenet.com.au
X-Spam-Level: 
X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00,FREEMAIL_FROM,
	HTML_MESSAGE,T_DKIM_INVALID autolearn=ham autolearn_force=no version=3.4.1
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=gmail.com; s=20120113;
        h=mime-version:from:date:message-id:subject:to;
        bh=2KD/ZRoFMXX1w/wfphcXugk2QYdzfa8nBJEoocyZUzo=;
        b=QOrXQNwhbxheQtrQBULMZo333aHCcF/TgQCuLVsR88r6+hMLAUSJAvUux+K3S59fQv
         KhvoxYhq99CUYXyQYtJ5xZ2wqDp/CtPZGiolVotcp6pBCYw+Fvtqc6zD83pTQbd3AoYQ
         FNAbSB6YkHe3vGMVeiHCsyBP2gTMM1ighADMq4IkvmHrjbpD9Ei2Bs0VLKYwA0IGVuuj
         az8FlcBs55yZdM1NgkoDfmbg3LfY7QzqxdN8BAdDTM6vgs5TYJtUdr4E5vzsgBq/qirD
         uNf7LSgx2v5tmp57XhQBjCQq8hImeJx0mZQK4zj0WqycnnlGRrlOaS9yt71UICYl9gSC
         9h1A==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=1e100.net; s=20130820;
        h=x-gm-message-state:mime-version:from:date:message-id:subject:to;
        bh=2KD/ZRoFMXX1w/wfphcXugk2QYdzfa8nBJEoocyZUzo=;
        b=CSc2UBQzh40ACAoQ3JSnXmk1WMB7xG0kWLnEhuWtr5g9h/EcoieRjKIxtVZ5jQfP/Q
         9A0j5b5p07SPMtxOX88oep+X3yNvsDCM91swdF9Ytif3Iy5ku/xOARlIayUmW4bi7ORc
         7uJG28fl9lT/FWKOHQ3BIagRJBa7agWY0Iif0qalfrTf2n0upEDb4I2amh4xvLOYXO4R
         7zH+ZtD2lZMx2qaJc5e1CbYV7mAVIdxgBzCflTlaqh43S1SGFdZvLrha4T1RIMfK0iLs
         tkA1P/5DNyB33M4tkvZcvquKxF973tc9Jp+ndP7zROJ+RxkWroLOcB4w+6Bde+XiSK+U
         W2LQ==
X-Gm-Message-State: ALyK8tLvow27PbOlVy0hY/C2O2L0JScaI/5tv4xdGw+QbaFPj0OY/f8ckJ9uXQL1kv12Hcuw0QnlSO0D8AA74w==
X-Received: by 10.36.228.78 with SMTP id o75mr22678466ith.47.1466048255726;
 Wed, 15 Jun 2016 20:37:35 -0700 (PDT)
MIME-Version: 1.0
From: "Duncan X. Simpson" <virtualdxs@gmail.com>
Date: Thu, 16 Jun 2016 03:37:26 +0000
Message-ID: <CAB8Qo2QMRV8p-uSRaDtceWebg9i9U-ywX600HQgpMXAENOsWUw@mail.gmail.com>
Subject: Restricted Mode Vuln
To: zsh-workers@zsh.org
Content-Type: multipart/alternative; boundary=94eb2c0472a4819ae505355cf5a5
X-Seq: zsh-workers 38691

--94eb2c0472a4819ae505355cf5a5
Content-Type: text/plain; charset=UTF-8

Restricted Mode should prevent the user from changing $IFS. One example of
an exploit:
http://linuxshellaccount.blogspot.com/2008/05/restricted-accounts-and-vim-tricks-in.html

Love this shell BTW
-- 

Duncan X. Simpson, K7DXS

--94eb2c0472a4819ae505355cf5a5--