Re: Safe TCL

Juergen Schoenwaelder (schoenw@cs.utwente.nl)
Tue, 30 Apr 1996 12:19:14 +0200

Hi!

mta@fmrco.com (Michael Askew) wrote:

> I am running TCL 7.4, TK 4.0 and Scotty 2.0.2 and wants to make/run a
> Scotty SNMP agent. When trying to do so
> I get the message that the Safe TCL extension is needed.

> What is unsafe about it?

You can easily write agents that evaluate code received over the net
(e.g. by a set operation). This can happen intentionally or it can
happen because you did not very carefully design your code (e.g. you
eval the value of a MIB variable). Obviously, this could cause
security problems and that is why you should make use of safe Tcl.

Juergen