Re: Another nice tmp race

From: Glynn Clements (glynnat_private)
Date: Wed Oct 28 1998 - 03:59:02 PST

Next message: Gary Gaskell: "Re: Firewall-1 Security Advisory"

Previous message: Georgi Guninski: "Javascript bug in Netscape Communicator 4.5"
Maybe in reply to: Stefan Laudat: "Another nice tmp race"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Stefan Laudat wrote:

>         Playing with my new shiny Slackware 3.5 box I have noticed
> something unusual. The in.pop3d daemon creates sometimes locks for some
> mailboxes in /usr/tmp/.pop. The directory is  drwxrwxrwt so there will be
> no problem in creating nice links to /zImage, /vmlinuz, /etc/shadow or
> whatever comes in your head. Be creative.

To clarify matters further:

1. The temp files are open()ed with O_EXCL, so (AFAIK) /usr/tmp/.pop
would have to be on an NFS filesystem (or something else which doesn't
handle O_EXCL correctly) in order for there to be a race condition.

2. pop3d performs a setuid() to the user who has logged in before the
temp files are created, so any files would need to be group writable,
for pop3d's gid or supplementary gids.

The mailing list address for pop3d is pop3dat_private The maintainer
is now aware of this issue.

--
Glynn Clements <glynnat_private>

Next message: Gary Gaskell: "Re: Firewall-1 Security Advisory"
Previous message: Georgi Guninski: "Javascript bug in Netscape Communicator 4.5"
Maybe in reply to: Stefan Laudat: "Another nice tmp race"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 14:21:21 PDT