From owner-freebsd-audit Mon Nov 20 2: 0:24 2000 Delivered-To: freebsd-audit@freebsd.org Received: from gratis.grondar.za (grouter.grondar.za [196.7.18.65]) by hub.freebsd.org (Postfix) with ESMTP id 9C4F937B479; Mon, 20 Nov 2000 02:00:17 -0800 (PST) Received: from grondar.za (gratis.grondar.za [196.7.18.133]) by gratis.grondar.za (8.11.1/8.11.1) with ESMTP id eAKA09J18620; Mon, 20 Nov 2000 12:00:09 +0200 (SAST) (envelope-from mark@grondar.za) Message-Id: <200011201000.eAKA09J18620@gratis.grondar.za> To: Kris Kennaway Cc: audit@FreeBSD.ORG Subject: Re: m4 tempfile fix References: <20001119223947.A71937@citusc17.usc.edu> In-Reply-To: <20001119223947.A71937@citusc17.usc.edu> ; from Kris Kennaway "Sun, 19 Nov 2000 22:39:47 PST." Date: Mon, 20 Nov 2000 12:00:08 +0200 From: Mark Murray Sender: owner-freebsd-audit@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG > > Don't like it, particularly if the directory is reasonably long-lived. > >=20 > > All an attacker needs to do is spin-wait for your dir, then cd into it. > > mkdtemp() creates directories mode 0700 No problem, then. Looks good! M -- Mark Murray Join the anti-SPAM movement: http://www.cauce.org To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-audit" in the body of the message