#33150 [Opn->Fbk]: shtool php insecure temporary file creation

From: Date: Thu, 26 May 2005 12:59:10 +0000
Subject: #33150 [Opn->Fbk]: shtool php insecure temporary file creation
References: 1  Groups: php.bugs 
Request: Send a blank email to php-bugs+get-79548@lists.php.net to get a copy of this message 
 ID:               33150
 Updated by:       tony2001@php.net
 Reported By:      eromang at zataz dot net
-Status:           Open
+Status:           Feedback
 Bug Type:         Unknown/Other Function
 Operating System: UNIX
 PHP Version:      4.3.11
 New Comment:

Please try using this CVS snapshot:

  http://snaps.php.net/php4-STABLE-latest.tar.gz
 
For Windows:
 
  http://snaps.php.net/win32/php4-win32-STABLE-latest.zip




Previous Comments:
------------------------------------------------------------------------

[2005-05-26 13:56:00] eromang at zataz dot net

suggested fix:

-     tmpfile="$tmpdir/.shtool.$$"
-     rm -f $tmpfile >/dev/null 2>&1
-     touch $tmpfile
-     chmod 600 $tmpfile
+     tmpfile=mktemp "$tmpdir/.shtool.XXXXXX"

------------------------------------------------------------------------

[2005-05-26 13:43:40] eromang at zataz dot net

Description:
------------
Hello,

php is using a vulnerable version of shtool.

For more informations :

http://www.securityfocus.com/bid/13767?ref=rss

Regards



------------------------------------------------------------------------


-- 
Edit this bug report at http://bugs.php.net/?id=33150&edit=1

Thread (9 messages)

« previous php.bugs (#79548) next »