Re: crontab security question

[Mark Eichin <eichin@cygnus.com>]

In fact, anything using "find" and "rm" is vulnerable an attack of
this form. (find doesn't "protect" the chdir, so there's a narrow race
there -- and "-exec" gives a full path from the top of the tree, so
you get a second shot at it :-) NetBSD will probably have some fixes
to the "fts" functions in libc some time soon. A gnuish fix would be
to
	* protect the chdirs in gnu find (and make sure it doesn't
chdir back up, but either rewalks down or uses fchdir on handles it
kept around)
	* add an -exec-local option to find which does the exec from
the target directory, with a relative path, instead of from the top.

I haven't had time to work this up and send it in, and suspect that
others are already doing so (given that I've heard about the problem
third hand through other channels, it's certainly gotten around :-)