On Fri, 21 Oct 2011 19:59:59 EDT, [email protected] said: > Which I thought people really didn't care too much about anymore, I took a > quick look at one of my ubuntu 8.04lts boxes:
> These are so easy to fix/avoid, I don't know why developers are still > introducing them to their code. It's Ubuntu. What second userid is going to exploit the vulns? Not sure if the above deserves a smiley or not. But it's exactly the mindset that causes these bugs. In any case, the *right* answer isn't to play whack-a-mole fixing /tmp races, what you should be doing is using pam_namespace or similar so each user gets their own /tmp namespace.
pgpjFK4Onci82.pgp
Description: PGP signature
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
