Re: [Fwd: Truth about ssh 1.2.27 vulnerabiltiy]

[Casper Dik]

So, what about:

        char tmpl[] = "/tmp/dirXXXXXXX";
        char dir[sizeof(tmpl)];

        do {
            strcpy(x, tmpl);
            mktemp(x);
        } while (mkdir(x, 0700) != 0);

        bind(somesocket in dir x)
        rename(nameof socket, desired name of socket);

        rmdir(x);


Under proper uids; I think most UNIX domain sockets can stand renaming;
not sure if they all do.


Casper