On Mon, 16 Feb 2004 16:49:53 +0100, "Dr. Peter Bieringer" said: > logfile=/tmp/LiveUpdate.log <---!!!!!! > > Impact: > Before first run of LiveUpdate (like suggested in doc, user "symantec" does > this) a possible race condition via a symlink attack by another user will > result in the creation of a new file (as user "symantec") or appending > LiveUpdate log to an existent file (owned by user "symantec"). For bonus points, figure out what happens if you reboot and your /etc/fstab has this: none /tmp tmpfs mode=1777 0 0 The gift that keeps on giving. ;)
Attachment:
pgp00486.pgp
Description: PGP signature
