/tmp /var/tmp (sometimes a symlink to /tmp) /home /var/spool/mail/username Mail queue injection dir on some systems is world writeable and readable. Various X games have score files that can be written to/read from. Many 3rd party software packages create world readable/writeable files and directories: find / -type f -perm +002 find / -type d -perm +002 Lotsa places. Hence the importance of segregating areas users can write to, directly (/tmp) or indirectly (/var/log). Kurt Seifried, kurtat_private A15B BEE5 B391 B9AD B0EF AEB0 AD63 0B4E AD56 E574 http://seifried.org/security/ http://www.iDefense.com/
This archive was generated by hypermail 2b30 : Thu Apr 25 2002 - 07:26:57 PDT