race condition in .net core System.IO.Directory.Delete allowing deletion of entire drives

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Here's a link to the original reporting of this class of bug:
https://seclists.org/bugtraq/2000/May/67

In looking for how to deal with this problem on Windows, I discovered
that .net core has
essentially the same security bug.

That file system node might have been a directory when FindNextFile
returned it, but it's a symlink to c:\users now. Goodbye half your
data (on average) before hitting a locked file.

https://github.com/dotnet/corefx/issues/32082

Microsoft does not want to believe this is a security bug. I do not
know what to do.



[Index of Archives]     [Linux Security]     [Netfilter]     [PHP]     [Yosemite News]     [Linux Kernel]

  Powered by Linux