Hi, * Javier Fernández-Sanguino Peña <[EMAIL PROTECTED]> [2005-11-05 02:06]: > Package: note > Version: 1.3.1-2 > Priority: important > Tag: security > > The 'note' program sets up temporary files in an unsafe way which leads to > race conditions since it first generates a temporary filename (but does not > create the file), removes it (twice, first race condition) and then tries to > output to the tempotary filename (second race condition). The filename > randomness is generate ad hoc and an attacker could have a hard time getting > it through but it really makes no sense to do it this way when File::Temp is > already available. > > Also, in the sources and provided as an example, the 'strestest' script has a > temporary symlink vulnerabity and a small bug (the temporary file is not > removed on program exit). Instead of writting to /tmp/xxx.$$ is should use > tempfile. > > The attached patch fixes both issues.
Thanks, package upload will come today. Looking forward to your patches :) Regards Nico -- Nico Golde - JAB: [EMAIL PROTECTED] | GPG: 0x73647CFF http://www.ngolde.de | http://www.muttng.org | http://grml.org Forget about that mouse with 3/4/5 buttons - gimme a keyboard with 103/104/105 keys!
pgpMSYThQXEwT.pgp
Description: PGP signature
