Bugtraq mailing list archives

Wietse's RPCBIND


From: wietse () PORCUPINE ORG (Wietse Venema)
Date: Fri, 10 Apr 1998 15:26:47 -0400


"My" rpcbind (which is mostly SUN code) does:

        unlink(savefile);
        fopen(savefile);

Thus, the time window is small. Moreover, you get only one chance;
once rpcbind is gone, someone has to restart it by hand. I figure
that if you slow down the file system enough, and fill up the open
file table, there will be a way to sneak in.

The fix is to open the save file with the O_EXCL flag set. I'm
about to leave for a week. I'll see if I can get out an update
today, otherwise it will have to be a week later.

        Wietse



Current thread: