bugThe nmh Mail Handling System - Bugs: bug #18635, nmh-1.2: Implement HAVE_MKSTEMP...

 
 

bug #18635: nmh-1.2: Implement HAVE_MKSTEMP case in m_scratch()

Submitted by:  Craig Leres <leres>
Submitted on:  Fri 29 Dec 2006 08:51:02 PM UTC  
 
Category: BugSeverity: 3 - Normal
Priority: 5 - NormalStatus: Duplicate
Assigned to: NoneOpen/Closed: Closed

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Thu 04 Feb 2010 08:16:48 AM UTC, comment #4:

Agreed.

Peter Maydell <pm215>
Project Administrator
Thu 04 Feb 2010 01:26:06 AM UTC, comment #3:

This is really a duplicate of bug #15213 and the problem
of removing the use of mktemp().

I do not have privs to edit information about the bug.
I recommend tagging this one as a dup.

Earl Hood <ehood>
Project Member
Sun 29 Apr 2007 11:33:20 PM UTC, comment #2:

I've just had another look, and the m_tmpfil.c patch is definitely wrong. It does this:

fd = mkstemp (tmpfil);
if (fd < 0)
adios("failed", "mkstemp");
(void)close(fd);
(void)unlink(tmpfil);

Unlinking the file here means that an attacker still has a window where they can create their own dodgy symlink before the nmh code reopens the file. So the race condition still exists and all we've done is silence the linker warning.

The m_scratch.c patch may be at least an improvement on the current code, since it does not do an unlink(). This still leaves it open to possible races on systems with subornable /tmp/ cleaners though, I think.

Peter Maydell <pm215>
Project Administrator
Sun 31 Dec 2006 03:51:51 AM UTC, comment #1:

Here's a patch for m_tmpfil.c

(file #11650)

Craig Leres <leres>
Fri 29 Dec 2006 08:51:02 PM UTC, original submission:

This patch adds code to use mkstemp() in m_scratch()

Craig Leres <leres>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #11650:  m_tmpfil.c.patch added by leres (620B - application/octet-stream)
file #11624:  m_scratch.c.patch added by leres (666B - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by ehood (Posted a comment)
  • -unavailable- added by pm215 (Posted a comment)
  • -unavailable- added by leres (Submitted the item)
  •  

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 6 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Thu 04 Feb 2010 08:16:48 AM UTCpm215StatusNone=>Duplicate
      Open/ClosedOpen=>Closed
    Mon 29 Dec 2008 10:43:51 PM UTCpm215CategoryNone=>Bug
    Sun 31 Dec 2006 03:51:51 AM UTCleresAttached File-=>Added m_tmpfil.c.patch, #11650
    Fri 29 Dec 2006 08:51:02 PM UTCleresAttached File-=>Added m_scratch.c.patch, #11624
      Carbon-Copy-=>Added -unavailable-

    Back to the top


    Powered by Savane 3.1-cleanup1