Page History

...

One common difference between implementations is whether or not environment variables are case sensitive.  While UNIX-like implementations are generally case sensitive, environment variables are "not case sensitive in Windows 98/Me and Windows NT/2000/XP" \[[MSDN|AA. Bibliography#MSDN]\].

...

On an IA-32 Linux machine with GCC Compiler Version 3.4.4, this code prints:

foo

whereas, on an IA-32 Windows XP machine with Microsoft Visual C++ 2008 Express, it prints:

bar

Compliant Solution

...

if (putenv("TEST_ENV=foo") != 0) {
  /* Handle error */
}
if (putenv("OTHER_ENV=bar") != 0) {
  /* Handle error */
}

const char *temp = getenv("TEST_ENV");

if (temp == NULL) {
  /* Handle error */
}

printf("%s\n", temp);

Risk Assessment

An adversary attacker can create multiple environment variables with (for example, by using the POSIX execve() function). If the program checks one copy but uses another, security checks may be circumvented.

Automated Detection

...

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Other Languages

Related Guidelines

CERT This rule appears in the C++ Secure Coding Standard as : ENV02-CPP. Beware of multiple environment variables with the same effective name.

Bibliography

unmigrated-wiki-markup

\[[ISO/IEC 9899:1999|AA. Bibliography#ISO/IEC 9899-1999]\] Section 7.20.4, "Communication with the environment" \[[Environment"

ISO/IEC PDTR 24772|AA. Bibliography#ISO/IEC PDTR 24772]\] TR 24772 "XYS Executing or Loading Untrusted Code"

MITRE CWE: CWE-462, "Duplicate Key in Associative List (Alist)"

MITRE CWE: CWE-807, "Reliance on Untrusted Inputs in a Security Decision"

Bibliography

\[[MITRE 07|AA. Bibliography#MITRE 07]\] [CWE-462|http://cwe.mitre.org/data/definitions/462.html], "Duplicate Key in Associative List (Alist)," [CWE-807|http://cwe.mitre.org/data/definitions/807.html], "Reliance on Untrusted Inputs in a Security Decision"
\[[MSDN|AA. Bibliography#MSDN]\] [{{getenv()}}|http://msdn.microsoft.com/en-us/library/tehxacec(VS.71).aspx]

...