Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 18 May 2011 16:41:29 -0400
From: Dan Rosenberg <>
To: maximilian attems <>
Subject: Re: [klibc] CVE request: klibc: ipconfig sh script
 with unescaped DHCP options

On Wed, May 18, 2011 at 4:29 PM, maximilian attems <> wrote:
> On Wed, May 18, 2011 at 04:13:05PM -0400, Dan Rosenberg wrote:
>> Might it be worth fixing the insecure temporary file usage?
>> 122         snprintf(fn, sizeof(fn), "/tmp/net-%s.conf", dev->name);
>> 123         f = fopen(fn, "w");
>> What if someone else has already created that file, or put a symlink
>> or hard link there?
> for the initramfs case I don't see how.
> outside of initramfs usage I'd agree that this needs fixing.

Right, this only applies after boot is done.

>> What if someone overwrites your string with
>> command injection characters despite your stripping?
> please be more verbose, what example do you have in mind?

Sorry for not being clear.  If you're concerned about scripts parsing
this file while it has command injection strings in it, what's to stop
someone from putting a malicious file there if one doesn't already
exist?  It sounds like the scripts that depend on this file should
probably be fixed here, or the file itself should be moved to a
location where it's not writable by unprivileged users.


> thank you for the review.
> --
> maks

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.