Skip to Content.
Sympa Menu

sm-security - [SM-Security] [Bug 7530] [sorcery/installwatch] insecure tmp file handling vulnerability

sm-security AT lists.ibiblio.org

Subject: Security bugs are reported here via bugzilla

List archive

Chronological Thread  
  • From: bugzilla-daemon AT metalab.unc.edu
  • To: sm-security AT lists.ibiblio.org
  • Subject: [SM-Security] [Bug 7530] [sorcery/installwatch] insecure tmp file handling vulnerability
  • Date: Tue, 19 Oct 2004 00:28:29 -0400

http://bugs.sourcemage.org/show_bug.cgi?id=7530

acedit AT armory.com changed:

What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |RESOLVED
Resolution| |FIXED



------- Additional Comments From acedit AT armory.com 2004-10-19 00:28 -------
This should be fixed with change 45229, the file now lives in a
unique /tmp/sorcery sub-directory directory which is owned by root.
/tmp/sorcery is guarenteed to be owned by root with perms 755, if it
isnt sorcery makes sure it is. The actual $TMP_DIR is guarenteed to be
created by cast with perms 755 and owned by root, if it already exists its
removed and re-created. In other words there shouldnt be any way for an
attacker to place clever symlinks in $TMP_DIR without being root.

Thanks for pointing out this class of exploits. Had I known earlier I would
have spent more time moving files to safer locations rather than taking
the "if its not broken dont fix it" approach.

Let me know if there are any weaknesses in libmisc::mk_tmp_dirs, and
if possible ways to fix it.



------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.




Archive powered by MHonArc 2.6.24.

Top of Page