[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Full-disclosure] Symlink vulnerabilities



On Fri, 21 Oct 2011 19:59:59 EDT, bugs@xxxxxxxxxxx said:

> Which I thought people really didn't care too much about anymore, I took a
> quick look at one of my ubuntu 8.04lts boxes:

> These are so easy to fix/avoid, I don't know why developers are still
> introducing them to their code.

It's Ubuntu.  What second userid is going to exploit the vulns?

Not sure if the above deserves a smiley or not.  But it's exactly the
mindset that causes these bugs.

In any case, the *right* answer isn't to play whack-a-mole fixing /tmp races,
what you should be doing is using pam_namespace or similar so each user gets
their own /tmp namespace.

Attachment: pgpIL_H63Z6V4.pgp
Description: PGP signature

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/