Re: [Fwd: Etch's and Lenny's mktemp seriously broken]
On Sat, Aug 16, 2008 at 04:16:19PM +0200, Sven Joachim wrote:
> On 2008-08-16 13:44 +0200, Tzafrir Cohen wrote:
>
> > On Fri, Aug 15, 2008 at 10:56:06PM +0200, Sven Joachim wrote:
> >> It opens precisely the can of worms that mktemp was supposed to close,
> >> see the mktemp(1) and mktemp(3) manpages. Look for "symlink attack" in
> >> your preferred Web search engine.
> >
> > And what BadThings happen due to that unlink?
>
> An attacker may recreate the file as a symlink to some other file whose
> contents will be overwritten when your shell script later writes to it.
Hmm.. I misread you. The man page states:
-u Operate in ‘‘unsafe’’ mode. The temp file will be unlinked before
mktemp exits. This is slightly better than mktemp(3) but still intro‐
duces a race condition. Use of this option is not encouraged.
There are simpler ways to shoot yourself in the foot. E.g.: don't use
mktemp at all.
mktemp -u is not just not safe. Don't use it.
--
Tzafrir Cohen | tzafrir@jabber.org | VIM is
http://tzafrir.org.il | | a Mutt's
tzafrir@cohens.org.il | | best
ICQ# 16849754 | | friend
Reply to: