full-disclosure - Re: Vulnerability in FortiClient SSL VPN

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Mon, 30 May 2011 09:13:55 -0400
From: Valdis.Kletnieks@...edu
To: magikh0e <magikh0e@...b.org>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: Vulnerability in FortiClient SSL VPN - Linux

On Sun, 29 May 2011 18:47:28 EDT, magikh0e said:

> Create a symlink from /tmp/forticlientsslvpn.lock
> to /some/file/owned_by_root as a non-root user. Then run the
> forticlientsslvpn client as root and the file you pointed at will then
> be overwritten upon execution.

Gaah.  People are *still* getting this one wrong?  I mean, hasn't
the problem of /tmp races been here since at least V6 if not
earlier? So this problem has been here longer than most of the
readers of this list.  And proper solutions have been around for
at least 2 decades or so, as well.

Makes one wonder what *else* they got wrong.  Gotta worry when
bozos write security-sensitive software...

Content of type "application/pgp-signature" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/