Hacker News Reader

Comment by GekkePrutser | Hacker News Reader

[OpenBSD Netcat] "In addition to those enhancements it is compiled to remove a feature that is considered a gaping security hole of the application."

I wonder what feature this was? The site doesn't elaborate.

Edit: Ah I saw the thing about the -e later on but I didn't think that was it as indeed it's not really a security hole imo. Rather just a tool.

View on HN

-c and -e. They're not security holes, they're useful features which like most powerful tools can be misused or abused.

The post does a poor job explaining it, but the term "gaping security hole" comes from traditional netcat's source code. In order to enable the "-e" (exec) flag, it must be compiled with "-DGAPING_SECURITY_HOLE".

I believe the reason they are called "gaping security holes" is that if nc is installed as setuid root, they allow local privilege escalation (see https://serverfault.com/questions/237584/netcat-e-the-gaping..., https://nc110.sourceforge.io/). Another explanation is that they make it trivial to create reverse shells etc. (though it is still possible to create reverse shells without -e/-c, for example using named pipes).

Ah yeah it was the security hole description that threw me off. I was expecting something more along the lines of a buffer overflow.

The article definitely did elaborate, but not as much as I would have liked.

The feature is the -e option, which is used (among other things) for reverse shells.

Reply on news.ycombinator.com