[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 18 Aug 2008 13:36:43 +0200
From: Nico Golde <oss-security+ml@...lde.de>
To: oss-security@...ts.openwall.com
Subject: Re: CVE id request: mktemp
Hi Sebastian,
* Sebastian Krahmer <krahmer@...e.de> [2008-08-18 13:25]:
> BTW, mktemp(1) is using O_EXCL anyway, so I dont see
> an issue. Additionally all of our scripts use
> more than 6 X' as also shown in the
> example section of the manpage. We are not going to
> release updates for this non-issue.
This is known but as I wrote in the bug report:
"the file is safely created with O_EXCL and 0600, still
unsafe if used with -u"
Kind regards
Nico
--
Nico Golde - http://www.ngolde.de - nion@...ber.ccc.de - GPG: 0x73647CFF
For security reasons, all text in this mail is double-rot13 encrypted.
[ CONTENT OF TYPE application/pgp-signature SKIPPED ]
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Powered by Openwall GNU/*/Linux -
Powered by OpenVZ
