Bug#174987: tetex-bin: xdvi wrapper has a temporary file race condition (security hole)

[Julian Gilbey <jdg@polya.uklinux.net>]

On Sat, Jan 04, 2003 at 09:34:39PM -0500, Matt Zimmerman wrote:
> > The point, though, is: once the file has been created, a symlink
> > attack can be used if the directory is world-writeable (with no sticky
> > bit set).  Does tempfile only create files in "safe" directories?
> 
> man tempfile:
> 
>        The directory to place the file is searched for in the following order:
> 
>        a)     The directory specified by the environment variable  TMPDIR,  if
>               it is writable.
> 
>        b)     The directory specified by the --directory argument, if given.
> 
>        c)     The directory /tmp.

No, that's not good enough as this bug report points out: if TMPDIR is
specified and is world-writable without a sticky bit, or if /tmp is
similarly, then this opens us up for a race condition.

I don't have a good suggestion for how to fix tempfile properly, other
than for it to test the directory and to fail if these conditions are
not properly met.

I'm going to send this on to security.

   Julian

-- 
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

        Julian Gilbey, website: http://www.polya.uklinux.net/
   Debian GNU/Linux Developer, see: http://people.debian.org/~jdg/
     Visit http://www.thehungersite.com/ to help feed the hungry