[8550] in bugtraq
Re: Xinetd /tmp race?
daemon@ATHENA.MIT.EDU (Pavel Kankovsky)
Sat Nov 14 15:55:45 1998
Date: Sat, 14 Nov 1998 00:12:53 +0100
Reply-To: peak@kerberos.troja.mff.cuni.cz
From: Pavel Kankovsky <peak@KERBEROS.TROJA.MFF.CUNI.CZ>
X-To: Marc Heuse <marc@SUSE.DE>
To: BUGTRAQ@NETSPACE.ORG
In-Reply-To: <199811130809.JAA24220@Galois.suse.de>
On Fri, 13 Nov 1998, Marc Heuse wrote:
> + dump_fd = open( dump_file, O_WRONLY + O_CREAT + O_EXCL, DUMP_FILE_MODE ) ;
> + if ( dump_fd == -1 )
> + {
> + if ( lstat( dump_file, &stat) != 0)
> + {
> + msg( LOG_ERR, func, "failed to open %s: %m", dump_file ) ;
> + return ;
> + }
> + if (stat.st_uid != getuid())
> + {
> + msg( LOG_ERR, func, "security: I'm not owning %s: %m", dump_file ) ;
> + return ;
> + }
> + dump_fd = open( dump_file, O_WRONLY + O_APPEND) ;
> + }
ln /etc/passwd /tmp/whatever_the_filename_was
I wonder whether my first message suggesting to create a file under a
randomized filename (with mkstemp() for instance) and rename (which
should be safer) ended into Aleph1's /dev/null ;)
strcpy(tmp_filename, "/path/blahXXXXXX");
dump_fd = mkstemp(tmp_filename);
if (dump_fd != -1) {
if (rename(tmp_filename, real_filename) == -1) {
save_errno = errno;
close(dump_fd); dump_fd = -1;
unlink(tmp_filename);
errno = save_errno;
}
}
(of course, one must be careful not to introduce a buffer overrun
during tmp_filename construction)
--Pavel Kankovsky aka Peak [ Boycott Czech Telecom--http://www.bojkot.cz ]
"spt Telecom... ted zdrazujeme zitrek!" [ Engl. lang. info-- .../english/ ]
