Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Thu, 21 Feb 2008 17:26:12 +0100
From: Marcus Meissner <>
Subject: Acrobat Reader 8.1.2 tmp racy wrapper script


I wonder if we will ever get rid of tmpraces, but /usr/bin/acroread from
Acrobat Reader 8.1.2 has this gem that shows someone is forgetting the
past again:

	    if [ "${mktemp_count+set}" != "set" ]; then


	    while /usr/bin/test -e "$mktemp_file"
		mktemp_count="`expr $mktemp_count + 1`"

	    touch "$mktemp_file" && chmod 644 "$mktemp_file" && echo "$mktemp_file"

called by:

	LOGFILE="`MkTemp /tmp/ssl_logXXXXXX`"
	CERTNAME="`MkTemp /tmp/certi.cerXXXXXX`"
	CERTDATA="`MkTemp /tmp/certDataXXXXXX`"

They seem to have replaced perfectly fine "mktemp" calls by their own unsecure
wrapper again. Just replace it back by "mktemp" and it will work.

No CVE allocated yet. I also have mailed PSIRT @ youknowhere.

Since this code is only run if you start acroread with special options, it is not
that problematic.

Ciao, Marcus
Working, but not speaking, for the following german company:
SUSE LINUX Products GmbH, GF: Markus Rex, HRB 16746 (AG Nuernberg)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.