[19330] in bugtraq
Re: HeliSec: StarOffice symlink exploit
daemon@ATHENA.MIT.EDU (Christian)
Thu Feb 22 13:22:17 2001
Mail-Followup-To: JeT Li <jet_li_man@yahoo.com>, BUGTRAQ@SECURITYFOCUS.COM
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Message-Id: <20010222115051.A8880@diffie.it.murdoch.edu.au>
Date: Thu, 22 Feb 2001 11:50:51 +0800
Reply-To: Christian <christian@dijkstra.MURDOCH.EDU.AU>
From: Christian <christian@dijkstra.MURDOCH.EDU.AU>
X-To: JeT Li <jet_li_man@yahoo.com>
To: BUGTRAQ@SECURITYFOCUS.COM
In-Reply-To: <01021717035200.05311@JeT-Li>; from jet_li_man@yahoo.com on Sat,
Feb 17, 2001 at 04:57:23PM +0100
On Sat, Feb 17, 2001 at 04:57:23PM +0100, JeT Li wrote:
> StarOffice creates a temporary directory in /tmp called soffice.tmp,
> with permissions 0777. Into this directory other temporary files are creates,
> with the format: svZZZZ.tmp, where ZZZZ in a four or five digits number.
<snip>
I reported this problem to BUGTRAQ on November 8, 2000. See
http://www.securityfocus.com/bid/1922 for more details. I believe Sun
has now released patches for this issue. It always helps to do a search
before reporting a "new" vulnerability. :-)
Regards,
Christian.
