bugtraq - Re: Symlink Vulnerability in GNU libtool <1.5.2

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Tue, 3 Feb 2004 21:49:11 +0000
From: Gary V.Vaughan <gary@....org>
To: Scott James Remnant <scott@...split.com>
Cc: bugtraq@...urityfocus.com, Libtool Bugs <bug-libtool@....org>,
	"Joseph S. Myers" <jsm@...yomino.org.uk>,
	Libtool Patches <libtool-patches@....org>
Subject: Re: Symlink Vulnerability in GNU libtool <1.5.2


On Tuesday, February 3, 2004, at 08:33  pm, Scott James Remnant wrote:
> On Tue, 2004-02-03 at 09:47, Joseph S. Myers wrote:
>> The chmod has a race (that access to the temporary directory could be
>> gained after it is created but before it is chmoded)
>>
> Would this patch be sufficient?  Gary et al. okay to apply if it is?
>
> 2003-02-03  Scott James Remnant  <scott@...split.com>
>
> 	* ltmain.in: Create temporary directory under a strict umask
> 	rather than running chmod afterwards, preventing a race
> 	condition where the directory could be replaced with a symbolic
> 	link in the time between the two commands.

Looks good from here.

Cheers,
	Gary.
-- 
Gary V. Vaughan      ())_.  gary@...lith.warpmail.net,gnu.org}
Research Scientist   ( '/   http://www.oranda.demon.co.uk
GNU Hacker           / )=   http://www.gnu.org/software/libtool
Technical Author   `(_~)_   http://sources.redhat.com/autobook