This scripts vs binaries situation reminds me of something in the linux kernel: you can't use the sticky bit against scripts. When you add it, it shows as sticky in 'ls -lF' but doesn't work when you go to run it. Sticky bit is only for binaries.
It seems stupid, but on the other hand I never see people abusing the sticky bit, possibly as a result of the higher barrier to entry.
On the other hand, it causes me inconvenience every time I want to do something legitimate with it.
Scripts with interpreters expose a race condition vulnerability whereby an attacker can quickly replace the script with their own before the interpreter, running with higher level privileges, finishes loading.
It is not really a script vs. binary issue so much as protecting against how scripts are loaded.
Comments
This scripts vs binaries situation reminds me of something in the linux kernel: you can't use the sticky bit against scripts. When you add it, it shows as sticky in 'ls -lF' but doesn't work when you go to run it. Sticky bit is only for binaries.
It seems stupid, but on the other hand I never see people abusing the sticky bit, possibly as a result of the higher barrier to entry.
On the other hand, it causes me inconvenience every time I want to do something legitimate with it.
Scripts with interpreters expose a race condition vulnerability whereby an attacker can quickly replace the script with their own before the interpreter, running with higher level privileges, finishes loading.
It is not really a script vs. binary issue so much as protecting against how scripts are loaded.