Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security Vuln-Dev
[Top] [All Lists]
<prev [Date] next>
[Advanced]
 <prev [Thread] next>

Re: [Full-disclosure] Vim: Insecure Temporary File Creation During Build

from [Steven M. Christey] Network Security [Permanent Link]
Subject: Re: [Full-disclosure] Vim: Insecure Temporary File Creation During Build: Arbitrary Code Execution
Date: Fri, 25 Jul 2008 11:57:28 -0400 (EDT) 

On Fri, 25 Jul 2008, [UTF-8] Jan MinÃÅ^Y wrote:


The commands do not have to be written there between (1) and (2), they
can be in the file long before the ./configure was started -- just
because the script does care whether it can write to the file at all.
So unlike stated in the advisory, and in CVE-2008-3294, the issue does
not involve a race condition if the attacker would choose to create a
644 file.


The file gets truncated in (1).  You're wrong, the advisory is right.


Maybe the point here is that if the attacker owns the file and sets 644
permissions, then the truncation won't happen since ./configure won't have
the permissions to modify the file.

- Steve
[More messages with this same subject...]




<Prev in Thread] Current Thread [Next in Thread>
Previous by Date:  ezContents CMS Renote File inclusion, security
Next by Date:  [Full-disclosure] Re : CAU-EX-2008-0002: Kaminsky DNS Cache Poisoning Flaw Exploit, tixxDZ
Previous by Thread:  Re: [Full-disclosure] Vim: Insecure Temporary File Creation During Build: Arbitrary Code Execution, Robert Buchholz
Next by Thread:  Re: [Full-disclosure] Vim: Insecure Temporary File Creation During Build: Arbitrary Code Execution, Jan MinÃÅ
Indexes:  [Date] [Thread] [Top] [All Lists]