sec_stup[0] = "Who's your $USER?"

Overview copied from CVE candidate:

Name: CVE-2005-2508 (under review)
Status: Candidate
Description: dsidentity in Directory Services in Mac OS X 10.4.2 allows local users to add or remove user accounts.

Digging into the actual security advisory from Suresec we find the nasty details:

Vulnerability summary: dsidentity is a tool to add or remove users. For specific actions it is required that the user is in the admin group. The code being used to validate if a user is in the admin group or not uses getenv, as shown by the following code snippet:

char *envStr = nil;
envStr = getenv("USER"); //check for member of admin group
if ( (envStr != nil) && UserIsMemberOfGroup( inDSRef, inDSNodeRef, envStr, "admin" ) ) {
    return true;
}

This security hole has been found in numerous places at various times in the POSIX-era, but as illustrated it can still be found out in the wild. It's also very simple to explain and identify, thus qualifying nicely for a slot in my sec_stup[] array. Please note that although the security hole by itself is stupid, the person responsible for it most certainly is not. The major reasons for most security flaws are bad coding practices and lack of code reviews rather than stupidity. Lack of internal security audits could qualify as stupid, though.

If you didn't quite understand the problem of sec_stup[0], consider this small example:

[~]$ cat printuser.c && gcc printuser.c
int main() {
  printf("%s\n", getenv("USER"));
  return 0;
}
[~]$ ./a.out
olov
[~]$ env USER=root ./a.out
root