lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <1306779087.18575.13.camel@b0x>
Date: Mon, 30 May 2011 14:11:27 -0400
From: magikh0e <magikh0e@...b.org>
To: Valdis.Kletnieks@...edu
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: Vulnerability in FortiClient SSL VPN - Linux

Yep ;) I was a bit surprised about how they went out of the way to
create the existence of this one. This problem was solved in mkstemp
with the release of glibc 2.0.7. That was released May 22 1998...

Just in case they stumble upon this thread or for others that do not yet
understand this...
 
FIO03-J. Remove temporary files before termination
https://www.securecoding.cert.org/confluence/display/java/FIO03-J.+Remove+temporary+files+before+termination

FIO00-J. Do not operate on files in shared directories 
https://www.securecoding.cert.org/confluence/display/java/FIO00-J.+Do
+not+operate+on+files+in+shared+directories

FIO01-J. Create files with appropriate access permissions
https://www.securecoding.cert.org/confluence/display/java/FIO01-J.+Create+files+with+appropriate+access+permissions



On Mon, 2011-05-30 at 09:13 -0400, Valdis.Kletnieks@...edu wrote:
> On Sun, 29 May 2011 18:47:28 EDT, magikh0e said:
> 
> > Create a symlink from /tmp/forticlientsslvpn.lock
> > to /some/file/owned_by_root as a non-root user. Then run the
> > forticlientsslvpn client as root and the file you pointed at will then
> > be overwritten upon execution.
> 
> Gaah.  People are *still* getting this one wrong?  I mean, hasn't
> the problem of /tmp races been here since at least V6 if not
> earlier? So this problem has been here longer than most of the
> readers of this list.  And proper solutions have been around for
> at least 2 decades or so, as well.
> 
> Makes one wonder what *else* they got wrong.  Gotta worry when
> bozos write security-sensitive software...


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ