bugphpGroupWare - Bugs: bug #3412, insecure creation of temporary file

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #3412: insecure creation of temporary file

Submitter:  Norbert Bollow <nb>
Submitted:  Wed 30 Apr 2003 09:59:19 PM UTC
   
 
Category:  developer_tools Item Group:  SVN trunk (dev code)
Severity:  3 - Normal Priority:  5 - Normal
Status:  Fixed Privacy:  Public
Assigned to:  #2883 Open/Closed:  Closed
Component Version:  SVN Operating System:  None
Reproducibility:  Every Time Planned Release:  None
Fixed Release: 

Thu 01 May 2003 07:25:21 AM UTC, comment #1: 

I removed the files as they are not used since a few versions.

Invalid User ID <#2883>
Wed 30 Apr 2003 09:59:19 PM UTC, original submission:  

I had a quick look at the module developer_tools and noticed the following bug:

file: perl/lang_extract.pl
line 47 says. srand(100000);
this is very bad, it uses the same random seed every time the script is run.

that makes the value of int(rand(100000)) in line 58 trivial to predict (it's always the same).   Anyone who has write access in $tmpdir can put a symbolic link there and cause overwriting of a file.

replacing line 47 with srand(); is only a little better, as srand(time) is still very predictable.  Go to CPAN and grab code for creating a temp file securely, or rewrite things to avoid needing to use a temporary file.

Norbert Bollow <nb>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

CC list is empty

 

There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

 

Follow 3 latest changes.

Date Changed by Updated Field Previous Value => Replaced by
2003-05-01 #2883 StatusNone None
    Open/ClosedOpen None
2003-04-30 skwashd Assigned toNone None

Back to the top

Powered by Savane 3.13-d3ae.
Corresponding source code