[13641] in bugtraq
Re: Tempfile vulnerabilities
daemon@ATHENA.MIT.EDU (Grant Taylor)
Tue Feb 1 17:39:49 2000
Message-Id: <200002010455.XAA20677@pace.picante.com>
Date: Mon, 31 Jan 2000 23:55:18 -0500
Reply-To: Grant Taylor <gtaylor+bugtraq_hcdbb013100@PICANTE.COM>
From: Grant Taylor <gtaylor+bugtraq_hcdbb013100@PICANTE.COM>
X-To: BUGTRAQ@SECURITYFOCUS.COM
To: BUGTRAQ@SECURITYFOCUS.COM
In-Reply-To: <Pine.BSF.4.10.10001302253420.89123-100000@blacklisted.intranova.net>
>>>>> foo <foo@BLACKLISTED.INTRANOVA.NET> writes:
> In Autobuse's main perl script, line 96:
>
> if(!$test_run) {
> open OUT, ">/tmp/autobuse_report.$$"
> or die "can't open /tmp/autobuse_report.$$";
> select OUT;
> }
This is fixed, partly, in autobuse version snap949125599, and more so
in today's snap949380617, which uses this mktemp function:
sub get_tmpfile {
my $file;
do {
open RAN, "/dev/random" || die;
read(RAN,$foo,16);
close RAN;
$file = '/tmp/autobuse' . unpack('H16',$foo);
} while (-e $file || -l $file);
return $file;
}
This method is Linux-specific, but that's all I need. The fixed
autobuse is available at http://www.picante.com/~gtaylor/autobuse/
Note that Autobuse has, as far as I know, zero users (including me).
If I am wrong about this, please let me know!
--
Grant Taylor - gtaylor at picante.com - http://www.picante.com/~gtaylor/
Linux Printing HOWTO: http://www.picante.com/~gtaylor/pht/
