#10738: insecure temp file in testcc.sh, testcxx.sh
-----------------------+----------------------------------------------------
Reporter: vbraun | Owner:
Type: defect | Status: new
Priority: minor | Milestone:
Component: scripts | Keywords:
Author: | Upstream: N/A
Reviewer: | Merged:
Work_issues: |
-----------------------+----------------------------------------------------
Comment(by vbraun):
1. Naughtyuser creates symlink `/tmp/tmp/hkldfz-test-for-c-compiler-
6sokljkhsdhfdf.$$.c` -> `/home/gooduser/valuabledocument.tex` (replace $$
with pid, often the next pid is easy to guess).
1. Gooduser runs `testcc.sh`
1. Gooduser notices that `/home/gooduser/valuabledocument.tex` has been
overwritten.
Gooduser could, of course, have always used rm to delete his documents but
Naughtyuser does not have the permissions to delete another user's file.
--
Ticket URL: <http://trac.sagemath.org/sage_trac/ticket/10738#comment:2>
Sage <http://www.sagemath.org>
Sage: Creating a Viable Open Source Alternative to Magma, Maple, Mathematica,
and MATLAB
--
You received this message because you are subscribed to the Google Groups
"sage-trac" group.
To post to this group, send email to [email protected].
To unsubscribe from this group, send email to
[email protected].
For more options, visit this group at
http://groups.google.com/group/sage-trac?hl=en.
