Security bugs are reported here via bugzilla

[bugzilla-daemon AT metalab.unc.edu]

http://bugs.sourcemage.org/show_bug.cgi?id=7530

acedit AT armory.com changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|                            |FIXED



------- Additional Comments From acedit AT armory.com  2004-10-19 00:28 -------
This should be fixed with change 45229, the file now lives in a
unique /tmp/sorcery sub-directory directory which is owned by root.
/tmp/sorcery is guarenteed to be owned by root with perms 755, if it
isnt sorcery makes sure it is. The actual $TMP_DIR is guarenteed to be
created by cast with perms 755 and owned by root, if it already exists its
removed and re-created. In other words there shouldnt be any way for an
attacker to place clever symlinks in $TMP_DIR without being root.

Thanks for pointing out this class of exploits. Had I known earlier I would
have spent more time moving files to safer locations rather than taking
the "if its not broken dont fix it" approach.

Let me know if there are any weaknesses in libmisc::mk_tmp_dirs, and
if possible ways to fix it.



------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.