Page History

The getenv() function searches an environment list for a string that matches a specified name, and returns a pointer to a string associated with the matched list member. Due to the manner in which environment variables are stored, multiple environment variables with the same name can cause unexpected results. You may check one value, but return another.

Implementation Details

Depending on the implementation, a program may not consistently choose the same value if there are multiple environment variables with the same name. The GNU glibc library addresses this issue in getenv() and setenv() by always using the first variable it comes across, encounters and ignoring the rest. The POSIX unsetenv() will remove function removes all the entries matching the variable name. Other implementations are following this leadsuit.

char *temp;
char *copy;

if ((temp = getenv("TEST_ENV")) != NULL) {
  copy = (char *)malloc(strlen(temp) + 1);
  if (copy != NULL) {
    strcpy(copy, temp);
  }
  else {
    /* handle error condition */
  }

  copy[0] = 'a';
  setenv("TEST_ENV", copy, 1);
}
else {
  return -1;
}

In addition, it It is also possible to search through environ checking the environment for multiple entries of a variable. On POSIX systems, the environ variable can be used for this purpose. Any duplicate values are an indication of an attack; take appropriate action. It is unlikely that there would be a need for more than one variable of the same name.

Risk Assessment

An adversary could create several multiple environment variables with the same name. If the program checks against one copy , but actually uses another, this could be a clear problemsecurity checks may be circumvented.

...