Bugtraq mailing list archives
Re: Tempfile vulnerabilities
From: dugsong () MONKEY ORG (Dug Song)
Date: Mon, 31 Jan 2000 15:44:36 -0500
On Sun, 30 Jan 2000, foo wrote:
This weekend I decided to play around with a couple of network management tools on securityfocus.com ... upon review of the source, I noticed a bad trend. Both tools handle temporary files insecurely.
the l0pht's tempwatch tool is useful in rooting out such problems. http://www.l0pht.com/advisories/watch.txt (or /usr/ports/security/tempwatch on OpenBSD)...
- Check for the existence of your temporary file before you do anything with it: $SECUREDIR=/home/blah $tmpfile=$SECUREDIR/t.$$ if [ -e $tmpfile ]; then echo -e "ERROR! : temporary file exists, erasing!\r\n"; rm -rf $tmpfile fi
you still have an exploitable race here. a better way around this (esp. for program with many tmp files) is to use a temporary directory instead, as in OpenBSD's /etc/security script: umask 077 DIR=/tmp/_secure$$ TMP1=$DIR/_secure2 TMP2=$DIR/_secure3 if ! mkdir $DIR ; then printf "tmp directory %s already exists, looks like:\n" $DIR ls -alF $DIR exit 1 fi trap 'rm -rf $DIR; exit 1' 0 1 2 3 13 15 or if you're using OpenBSD, use the mktemp(1) program in your scripts: http://www.openbsd.org/cgi-bin/man.cgi?query=mktemp -d. --- http://www.monkey.org/~dugsong/
Current thread:
- Re: Tempfile vulnerabilities Dug Song (Jan 31)
- <Possible follow-ups>
- Re: Tempfile vulnerabilities foo (Jan 31)
- Re: Tempfile vulnerabilities Grant Taylor (Jan 31)
- Re: Tempfile vulnerabilities Theo de Raadt (Feb 01)
- Microsoft Security Bulletin (MS00-007) Aleph One (Feb 01)
- Re: Tempfile vulnerabilities Werner Koch (Feb 02)
- Re: Tempfile vulnerabilities Theo de Raadt (Feb 02)
- Evil Cookies. Iain Wade (Feb 02)
- UPDATE: Sygate 3.11 Port 7323 Telnet Hole jalerta () nestworks com (Feb 03)
- Re: Evil Cookies. Joachim Feise (Feb 03)
- Re: Evil Cookies. Jon Paul, Nollmann (Feb 05)