[DebianGIS-dev] Bug#508595: CVE-2008-5380: allows local users to overwrite arbitrary files via a symlink attack
Hamish
hamish_b at yahoo.com
Tue Dec 16 10:47:53 UTC 2008
note these helper scripts are not a core part of running the program.
$ grep /tmp/ *
geo-code:TMP=/tmp/geo$$
geo-code: cp $COORDS /tmp/geo.google
geo-code: filter="tee /tmp/geo.yahoo"
geo-code: cp $COORDS /tmp/geo.coords
geo-nearest: TMP=/tmp/geo
geo-nearest: TMP=/tmp/geo$$
geo-nearest: cp $GEOWAY /tmp/geocaching.loc
gpssmswatch:FILE=/tmp/.smswatch
gpssmswatch:NUMBER=`grep Sender /tmp/.smswatch|awk '{print $2}'`
gpssmswatch:cat /tmp/gpsdrivepos
gpssmswatch:gnokii --sendsms $NUMBER < /tmp/gpsdrivepos
these three are all shell/bash scripts.
possible fix:
TMP=`tempfile -p geo.`
if [ $? -ne 0 ] || [ -z "$TMP" ] ; then
echo "ERROR: Unable to create temporary files" 1>&2
exit 1
fi
see also comments here:
http://sourceforge.net/tracker/index.php?func=detail&aid=2121124&group_id=148048&atid=770280
Hamish
More information about the Pkg-grass-devel
mailing list