perl "Insecure dependency in `` while running setuid"

[123jainmin]

When I ran a perl script named script.pl which have the the follwing line:
system("echo hostname = $HOSTNAME > /tmp/myinfo");
I have another shell script script.ksh which simply call script.pl within the script. the permission on script.ksh is: -rwsr-sr-x
WHen I ran script.ksh, I got the error message:
Insecure dependency in `` while running setuid at script.pl line 4.
If I do not use $HOSTNAME in script.pl, I have no trouble at all.
Could someone help me on this? Looks like setuid and $HOSTNAME variable cannot work together.

Thanks in advance.

[bharad]

make sure you untaint the data before executing the scripts.

try this
if ($HOSTNAME =~ /^([ &:#-\@\w.]+)$/) {
$HOSTNAME = $1; #data is now untainted
} else {
print "bad data\n";
}

-bharad

When I ran a perl script named script.pl which have the the follwing line:
system("echo hostname = $HOSTNAME > /tmp/myinfo");
I have another shell script script.ksh which simply call script.pl within the script. the permission on script.ksh is: -rwsr-sr-x
WHen I ran script.ksh, I got the error message:
Insecure dependency in `` while running setuid at script.pl line 4.
If I do not use $HOSTNAME in script.pl, I have no trouble at all.
Could someone help me on this? Looks like setuid and $HOSTNAME variable cannot work together.

Thanks in advance.

[123jainmin]

Thank you so much! it works.