Wget race condition vulnerability (fwd)

2004-05-17 Thread Daniel Stenberg
I found this on the bugtraq mailing list and since I haven't seen it discussed here, I thought it could be informative. -- -=- Daniel Stenberg -=- http://daniel.haxx.se -=- ech`echo xiun|tr nu oc|sed 'sx\([sx]\)\([xoi]\)xo un\2\1 is xg'`ol -- Forwarded message --

Re: Wget race condition vulnerability (fwd)

2004-05-17 Thread Hrvoje Niksic
Thanks for forwarding this. The idea was for Wget to print the file name it will write to, and yet to refrain from creating the file until the data arrives. One way to solve this is to use O_EXCL when opening the file, and refusing to write to files that cannot be so opened. Essentially, Wget