bugGNU patch - Bugs: bug #26099, Use of 'mktemp' is dangerous

 
 

bug #26099: Use of 'mktemp' is dangerous

Submitter:  Andreas Gruenbacher <agruen>
Submitted:  Mon 06 Apr 2009 03:16:24 PM UTC
   
 
Category:  None Severity:  3 - Normal
Item Group:  None Status:  Fixed
Privacy:  Public Assigned to:  agruen
Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Wed 13 Oct 2010 10:20:21 PM UTC, comment #3: 

mktemp is no longer being used.

Andreas Gruenbacher <agruen>
Group administrator
Fri 07 May 2010 11:41:51 AM UTC, comment #2: 

Thanks, but that's not what's needed.  The way how patch uses mktemp() is mostly secure:

  mktemp (tmp);
  while ("there is another patch")
    {
      /* This is racy. */
      fd = open (tmp, O_CREAT|O_EXCL, 0666);
      close (fd);
      rename (tmp, outname);
    }

An attacker can launch a denial-of-service attack by creating file tmp before patch can open it, though (i.e., before the first open, or between a rename and the next open); that's the bad thing about it.  In addition, O_NOFOLLOW should be used to protect against symlink attacks.

I'll give fixing this a try myself.

PS.
Your commens shows up as Anonymous: I can't make use of anynymous code, anyway :(

Andreas Gruenbacher <agruen>
Group administrator
Thu 06 May 2010 09:18:51 PM UTC, comment #1: 

I did a patch for using mkstemp(). All tests succeed.
There's no change form chmod to fchmod or something like that.

(file #20474)

Anonymous
Mon 06 Apr 2009 03:16:24 PM UTC, original submission:  

When building patch, gcc complains that the use of mktemp is dangerous, and suggests to use mkstemp instead. While patch uses mktemp in a safe way, it would be nice to get rid of the warning.

At the same time, patch could switch from chmod to fchmod and from utime to futimes for added performance as well as safety.

Andreas Gruenbacher <agruen>
Group administrator

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #20474:  patch-2.6.1-mkstemp.patch added by None (8KiB - text/x-diff)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by agruen (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 5 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2010-10-13 agruen StatusPostponed Fixed
        Open/ClosedOpen Closed
    2010-05-06 None Attached File- Added patch-2.6.1-mkstemp.patch, #20474
    2009-04-11 agruen Assigned toNone agruen
    2009-04-06 agruen StatusNone Postponed

    Back to the top

    Powered by Savane 3.13-d3ae.
    Corresponding source code