Full Disclosure mailing list archives
openvas 2.x race condition
From: Bugs NotHugs <bugsnothugs () gmail com>
Date: Sun, 4 Sep 2011 16:56:48 -0600
openvas-server/openvas/oval_plugins.c [...] results_filename = "/tmp/results.xml"; if (g_file_test (results_filename, G_FILE_TEST_EXISTS)) { log_write ("Found existing results file in %s, deleting it to avoid conflicts.", results_filename);
it unlink /tmp/results.xml avoid symlink attack then spawn process that write stuff to /tmp/results.xml chinese apt can make symlink point to any system file during race and win race! -- BugsNotHugs Shared Vulnerability Disclosure Account _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- openvas 2.x race condition Bugs NotHugs (Sep 05)