buggnats - Bugs: bug #25577, Unsafe mktemp usage in send-pr.

 
 

bug #25577: Unsafe mktemp usage in send-pr.

Submitted by:  None
Submitted on:  Fri 13 Feb 2009 11:24:05 AM UTC  
 
Category: NoneSeverity: 3 - Normal
Item Group: NoneStatus: None
Privacy: PublicAssigned to: None
Open/Closed: Open

Add a New Comment (Rich MarkupRich Markup):
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Fri 13 Feb 2009 12:20:18 PM UTC, comment #1:

Oops, looked at a deleted file. Same report applies to gnats/gnats/send-pr.sh though:

http://cvs.savannah.gnu.org/viewvc/gnats/gnats/gnats/send-pr.sh?revision=1.5&view=markup

--
Malte Dehling
email: mdehling at some site called uni-math.gwdg.de

Anonymous
Fri 13 Feb 2009 11:24:05 AM UTC, original submission:

Temp-file is deleted but still used afterwords. A symlink could be created to overwrite some other file of the invoking user. The rm -f line is not needed at all i think.

(latest CVS version. rev. 1.26 branch MAIN. gnats/gnats/send-pr/send-pr.sh)

diff -uNi send-pr.sh.orig send-pr.sh
--- send-pr.sh.orig 2009-02-13 12:14:58.000000000 +0100
+++ send-pr.sh 2009-02-13 12:18:40.000000000 +0100
@@ -158,7 +158,6 @@
else
DEFAULT_ORIGINATOR="$FROM (`cat $TEMP`)"
fi
- rm -f $TEMP
fi

if [ -z "$ORGANIZATION" ]

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

CC list is empty

 

Do you think this task is very important?
If so, you can click here to add your encouragement to it.
This task has 0 encouragements so far.

Only logged-in users can vote.

 

Please enter the title of George Orwell's famous dystopian book (it's a date):

 

 

No Changes Have Been Made to This Item

Back to the top


Powered by Savane 3.1-cleanup