oss-sec mailing list archives
Re: CVE id request: mktemp
From: "Todd C. Miller" <Todd.Miller () courtesan com>
Date: Mon, 18 Aug 2008 08:03:15 -0400
In message <20080818113643.GC27231 () ngolde de> so spake Nico Golde (oss-security+ml):
This is known but as I wrote in the bug report: "the file is safely created with O_EXCL and 0600, still unsafe if used with -u"
-u Operate in ``unsafe'' mode. The temp file will be unlinked be- fore mktemp exits. This is slightly better than mktemp(3) but still introduces a race condition. Use of this option is not en- couraged. The manual explicitly says this option is unsafe. It should only be used when the directory in which you are making the temporary file is not writable by other users. Furthermore, you are only using 4 X's which makes it even less safe. - todd
Current thread:
- CVE id request: mktemp Nico Golde (Aug 15)
- Re: CVE id request: mktemp Todd C. Miller (Aug 15)
- Re: CVE id request: mktemp Sebastian Krahmer (Aug 18)
- Re: CVE id request: mktemp Nico Golde (Aug 18)
- Re: CVE id request: mktemp Todd C. Miller (Aug 18)
- Re: CVE id request: mktemp Steven M. Christey (Aug 18)
- Re: CVE id request: mktemp Nico Golde (Aug 18)
- Re: CVE id request: mktemp Nico Golde (Aug 18)
- Re: CVE id request: mktemp Todd C. Miller (Aug 18)
- Re: CVE id request: mktemp Nico Golde (Aug 18)