cluster: RHEL4 - ccsd: Fix bug 49898 - symlink attack vulnerabilities
Jonathan Brassow
jbrassow at fedoraproject.org
Thu May 20 16:32:40 UTC 2010
Gitweb: http://git.fedorahosted.org/git/cluster.git?p=cluster.git;a=commitdiff;h=bba9068b91f737b8f88cd26581eed5884f443bae
Commit: bba9068b91f737b8f88cd26581eed5884f443bae
Parent: 6330bbe58b809aaf5dffc4be87e632b427a4b568
Author: Jonathan Brassow <jbrassow at redhat.com>
AuthorDate: Thu May 20 11:31:49 2010 -0500
Committer: Jonathan Brassow <jbrassow at redhat.com>
CommitterDate: Thu May 20 11:31:49 2010 -0500
ccsd: Fix bug 49898 - symlink attack vulnerabilities
Fix vulnerability in CCS that would allow someone to
prevent a 'ccs_tool update'.
---
ccs/ccs_tool/upgrade.c | 7 ++++---
1 files changed, 4 insertions(+), 3 deletions(-)
diff --git a/ccs/ccs_tool/upgrade.c b/ccs/ccs_tool/upgrade.c
index b085407..cb844b9 100644
--- a/ccs/ccs_tool/upgrade.c
+++ b/ccs/ccs_tool/upgrade.c
@@ -193,7 +193,7 @@ static void ccs_dh_in(ccs_dh_t *dh, char *buf){
static int upgrade_device_archive(char *location){
int error = 0;
int dev_fd=-1, tmp_fd=-1;
- char tmp_file[64];
+ char tmp_file[128];
char *buffer = NULL;
ccs_dh_t dev_header;
@@ -229,9 +229,10 @@ static int upgrade_device_archive(char *location){
goto fail;
}
- sprintf(tmp_file, "/tmp/tmp_%d", getpid());
+ memset(tmp_file, 0, 128);
+ sprintf(tmp_file, "/tmp/ccs_tool_tmp_XXXXXX");
- tmp_fd = open(tmp_file, O_RDWR | O_CREAT |O_TRUNC, S_IRUSR|S_IWUSR);
+ tmp_fd = mkostemp(tmp_file, O_RDWR | O_CREAT |O_TRUNC);
if(tmp_fd < 0){
fprintf(stderr, "Unable to create temporary archive: %s\n", strerror(errno));
error = -errno;
More information about the cluster-commits
mailing list