oss-security - Re: CVE id request: mktemp

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / NEWS community lists Wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [<thread-prev] [thread-next>] [month] [year] [list]

Date: Mon, 18 Aug 2008 08:03:15 -0400
From: "Todd C. Miller" <Todd.Miller@...rtesan.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVE id request: mktemp 

In message <20080818113643.GC27231@...lde.de>
	so spake Nico Golde (oss-security+ml):

> This is known but as I wrote in the bug report:
> "the file is safely created with O_EXCL and 0600, still
> unsafe if used with -u"

 -u      Operate in ``unsafe'' mode.  The temp file will be unlinked be-
	 fore mktemp exits.  This is slightly better than mktemp(3) but
	 still introduces a race condition.  Use of this option is not en-
	 couraged.

The manual explicitly says this option is unsafe.  It should only
be used when the directory in which you are making the temporary
file is not writable by other users.  Furthermore, you are only
using 4 X's which makes it even less safe.

 - todd

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.