Re: [Full-disclosure] Symlink vulnerabilities



bugs@xxxxxxxxxxx wrote:

bashbug:

/usr/bin/bashbug:TEMPDIR=$TMPDIR/bbug.$$

Maybe I should use bashbug to report a bug in bashbug?


I took a quick look, it's actually using mkdir to create a temporary
directory in /tmp, which it uses for collecting support files.

This is actually a safe way to use /tmp, assuming you check the return code
of mkdir (which it does). The mkdir() system call behaves very differently
to open(), and is not vulnerable to these attacks.

Tavis.

--
-------------------------------------
taviso@xxxxxxxxxxxxx | pgp encrypted mail preferred
-------------------------------------------------------

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/



Relevant Pages

  • Re: [Full-disclosure] Symlink vulnerabilities
    ... Maybe I should use bashbug to report a bug in bashbug? ... it's actually using mkdir to create a temporary ... Charter: http://lists.grok.org.uk/full-disclosure-charter.html ... Hosted and sponsored by Secunia - http://secunia.com/ ...
    (Full-Disclosure)
  • Re: [RFC] IO scheduler based IO controller V9
    ... I happened to encount a bug when i test IO Controller V9. ... other tasks which access into "hdb" will also hang up. ... mkdir /cgroup/test1 ... rmdir /cgroup/test2/test3 ...
    (Linux-Kernel)
  • Re: [RFC] IO scheduler based IO controller V9
    ... I happened to encount a bug when i test IO Controller V9. ... The bug only happens when using AS io scheduler. ... mkdir /cgroup/test1 ... rmdir /cgroup/test2/test3 ...
    (Linux-Kernel)
  • Re: [RFC] IO scheduler based IO controller V9
    ... I happened to encount a bug when i test IO Controller V9. ... mkdir /cgroup/test1 ... echo "pid4: $pid4" ... rmdir /cgroup/test2/test3 ...
    (Linux-Kernel)
  • Re: [PATCH 02/20] blkio: Change CFQ to use CFS like queue time stamps
    ... this bug can be easily trigger by creating two cgroup and run a idle ... in this case we should be charging 1 ms but instead we will be charging ... mkdir /cgroup/tst1 ... rmdir /cgroup/tst1 ...
    (Linux-Kernel)