Full Disclosure mailing list archives
Re: Vulnerability in FortiClient SSL VPN - Linux
From: Valdis.Kletnieks () vt edu
Date: Mon, 30 May 2011 09:13:55 -0400
On Sun, 29 May 2011 18:47:28 EDT, magikh0e said:
Create a symlink from /tmp/forticlientsslvpn.lock to /some/file/owned_by_root as a non-root user. Then run the forticlientsslvpn client as root and the file you pointed at will then be overwritten upon execution.
Gaah. People are *still* getting this one wrong? I mean, hasn't the problem of /tmp races been here since at least V6 if not earlier? So this problem has been here longer than most of the readers of this list. And proper solutions have been around for at least 2 decades or so, as well. Makes one wonder what *else* they got wrong. Gotta worry when bozos write security-sensitive software...
Attachment:
_bin
Description:
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Vulnerability in FortiClient SSL VPN - Linux magikh0e (May 30)
- Re: Vulnerability in FortiClient SSL VPN - Linux Valdis . Kletnieks (May 30)
- Re: Vulnerability in FortiClient SSL VPN - Linux magikh0e (May 30)
- Re: Vulnerability in FortiClient SSL VPN - Linux Valdis . Kletnieks (May 30)