From owner-freebsd-security  Fri Dec 27 17:43:27 1996
Return-Path: <owner-security>
Received: (from root@localhost)
          by freefall.freebsd.org (8.8.4/8.8.4) id RAA21452
          for security-outgoing; Fri, 27 Dec 1996 17:43:27 -0800 (PST)
Received: from mail.cs.tu-berlin.de (root@mail.cs.tu-berlin.de [130.149.17.13])
          by freefall.freebsd.org (8.8.4/8.8.4) with ESMTP id RAA21447
          for <security@freebsd.org>; Fri, 27 Dec 1996 17:43:22 -0800 (PST)
Received: from campa.panke.de (anonymous214.ppp.cs.tu-berlin.de [130.149.17.214])
          by mail.cs.tu-berlin.de (8.8.4/8.8.4) with SMTP
	  id CAA05621; Sat, 28 Dec 1996 02:27:44 +0100 (MET)
Received: (from wosch@localhost) by campa.panke.de (8.6.12/8.6.12) id CAA01043; Sat, 28 Dec 1996 02:09:27 +0100
Date: Sat, 28 Dec 1996 02:09:27 +0100
From: Wolfram Schneider <wosch@cs.tu-berlin.de>
Message-Id: <199612280109.CAA01043@campa.panke.de>
To: Bruce Evans <bde@zeta.org.au>
Cc: security@freebsd.org
Subject: Re: FALSE ALARM: Re: Another buggy root cron job
In-Reply-To: <199612251345.AAA26072@godzilla.zeta.org.au>
References: <199612251345.AAA26072@godzilla.zeta.org.au>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 8bit
Sender: owner-security@freebsd.org
X-Loop: FreeBSD.org
Precedence: bulk

Bruce Evans writes:
>There's a similar potential hole in mkdep.  This hole is a bit larger
>than the one for the race in mktemp().  No one runs `make depend' or
>compiles things as root on public machines, right? ;-)

TMP=_mkdep$$ should fix the problem - it put the temp files into the
current working directory. The source tree or object tree 
should not be world writable ;-)

Wolfram