Bugtraq mailing list archives
Re: OSS nice tmp race
From: na98jen () STUDENT HIG SE (Joel Eriksson)
Date: Fri, 18 Dec 1998 22:41:40 +0100
On Thu, 17 Dec 1998, Stefan Laudat wrote:
While digging in the "soundon" script delivered with the OSS package (the commercial one, of course), I have discovered something very unusual on line 26 $MODTOOLS/insmod -V > /tmp/oss.tmp 2>&1 # KABOOM! "Hey, Beavis, told ya it was plutonium" MODVERS=`head -1 /tmp/oss.tmp|sed 's/.* //'` rm -f /tmp/oss.tmp # too late, buddy! Nice,huh? Just imagine that almost all soundcards are PnP today, there are few admins that know how to play with isapnp and ALSA (yeah, it rulez), the soundcfg or soundconf (whatever) script that comes with RedHat 5.x sucks big time and most of the ppl running LeeNw00x use OSS that seems to be a very good tool for the average RewT, honestly. And thank God OSS knows lots of soundcards! Most of you are running the soundon script in rc.local, so the satisfaction is guaranteed: ln -s /etc/inittab (next boot you're dead) Don't worry, support () opensound com has been already notified so they will correct the bug ASAP I guess. BTW there is no bugs () opensound com, so I love their optimistic way of thinking. I think the correct code is : ## insert before line 26 if [ -L /tmp/oss.tmp ] then logger "Hey,man, you've got a naughty (l)user -- ".`ls -lsa /tmp/oss.tmp` # die, lam0r! :) rm /tmp/oss.tmp fi
There still exist a race-condition in that code, it just demands better timing. If the checking for file-existence and the creation of the file cannot be done atomically, don't do it. In this case there is no need for a temporary file at all, IMHO a better way to fix the problem is: MODVERS=$($MODTOOLS/insmod -V 2>/dev/null | head -1 | sed 's/.* //') I think that would do the trick. There are of course cases where it's not this easy to get rid of the need for a temporary file, the best way to fix this problem I think would be if all users had their own private tmp-directory. I have heard of patches that makes /tmp to a pseudo-directory that is "private" for each user that may be useful (I think it was for Linux, but I don't think it is widely spread). Since programmers keep repeating the old mistakes over and over again, the responsibility is ultimately the users. One can't check all of the sourcecode that we compile (at least not as thouroughly that may be needed), but eliminating the possibility of certain common bugs from having any dangerous implications is a first step. I think solutions like StackGuard and the like is of great use when it comes to this.
Stefan Laudat
Joel Eriksson
Current thread:
- Re: wordperfect 8 for linux security, (continued)
- Re: wordperfect 8 for linux security Dug Song (Dec 18)
- Re: wordperfect 8 for linux security Keith Owens (Dec 18)
- Irc: another funny stuff. In some irc clients dcc may be hijacked. awgn () COSMOS IT (Dec 19)
- ValueClick CGI Vulnerability Philip Stoev (Dec 19)
- FTP.SODRE.NET Hacked... Eggdrop Modified.. Geoffrey Huntley (Dec 19)
- Re: FTP.SODRE.NET Hacked... Eggdrop Modified.. Matt Hallacy (Dec 19)
- ip header id patched. awgn () COSMOS IT (Dec 19)
- ValueClick Ellen (Dec 19)
- Re: OSS nice tmp race Pavel Kankovsky (Dec 18)
- Re: OSS nice tmp race Dr. Mudge (Dec 18)
- Re: OSS nice tmp race Joel Eriksson (Dec 18)
- OSS nice tmp race the razor of love (Dec 18)
- Re: OSS nice tmp race Crispin Cowan (Dec 20)
- Re: OSS nice tmp race X-Force (Dec 21)
- AOL client uses IP tunneling Aviram Jenik (Dec 21)
- Re: your mail Craig A. Huegen (Dec 21)
- Re: your mail Alan Cox (Dec 22)