This is indeed pretty low impact. It does not allow a symlink attack
since the file is deleted before usage, and the small race between
unlink() and bind() does not hurt too much either since bind() will just
fail if the file already exists. So there are two minor consequences:
* It removes a file /tmp/<port> which might just happen to be a file which you
still need
* It opens a small race condition for a local DoS.
** Changed in: spread (Ubuntu)
Importance: Medium => Low
Status: Unconfirmed => Confirmed
--
insecure socket file creation
https://launchpad.net/bugs/44171
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
