/* We have the SUID-root `insecure` binary which makes a call to system() at some point, exact call being: system("/bin/ls") */

/* I thought this would be insecure because of a construction like this: */

$ export IFS=/
/* The above line would mean "/" separates commands from their arguments and thus the command /bin/ls would actually mean: command `bin` with argv[1] == `ls` */

$ export PATH="./evil-dir"

/* And then in the directory evil-dir one could put a script named "bin" which would contain: #!/bin/bash -c echo just a test */

/* And now by running "insecure", this would call system("/bin/ls") which would actuall mean: "run program `bin` with argument `ls`", and since our PATH is modified, the program `bin` would be one of our choice. */
$ ./insecure
just a test

/* However, this does not work, so my assumptions were wrong, and I do NOT actually understand why system() is insecure. */

$ cat insecure.c
#include <stdio.h>
#include <stdlib.h>

int main(int argc, char **argv)
{
	printf("Executing: %s\n", argv[0]);
	system("/bin/ls");
	return EXIT_SUCCESS;
}
$ ./insecure 
Executing: ./insecure
ALL.txt  insecure  insecure.c
$ ls -al insecure
-rwxrwxrwx 1 reverse reverse 6.5K 2007-11-30 11:54 insecure
$ echo As you can see its not SUID nor SGID
As you can see its not SUID nor SGID
$ cat bin
echo this should get executed
$ ls -al bin 
-rwxrwxrwx 1 reverse reverse 30 2007-11-30 11:58 bin
$ export PATH="."
$ bin
this should get executed
$ export IFS="/"
$ echo "${IFS}"
/
$ insecure 
Executing: insecure
ALL.txt  bin  insecure  insecure.c