Re: Tempfile vulnerabilities

• Previous message: Dug Song: "Re: Tempfile vulnerabilities"
• Maybe in reply to: foo: "Tempfile vulnerabilities"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

>>>>> foo <fooat_private> writes:

> In Autobuse's main perl script, line 96:
>
>         if(!$test_run) {
>                 open OUT, ">/tmp/autobuse_report.$$"
>                         or die "can't open /tmp/autobuse_report.$$";
>                 select OUT;
>         }

This is fixed, partly, in autobuse version snap949125599, and more so
in today's snap949380617, which uses this mktemp function:

   sub get_tmpfile {
       my $file;
       do {
	   open RAN, "/dev/random" || die;
	   read(RAN,$foo,16);
	   close RAN;
	   $file = '/tmp/autobuse' . unpack('H16',$foo);
       } while (-e $file || -l $file);

       return $file;
   }

This method is Linux-specific, but that's all I need.  The fixed
autobuse is available at http://www.picante.com/~gtaylor/autobuse/

Note that Autobuse has, as far as I know, zero users (including me).
If I am wrong about this, please let me know!

--
Grant Taylor - gtaylor at picante.com - http://www.picante.com/~gtaylor/
    Linux Printing HOWTO:  http://www.picante.com/~gtaylor/pht/

• Next message: bugtestat_private: "UT DDoS risk"
• Previous message: Dug Song: "Re: Tempfile vulnerabilities"
• Maybe in reply to: foo: "Tempfile vulnerabilities"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 15:32:50 PDT