#33150 [Com]: shtool php insecure temporary file creation

ID: 33150 Comment by: koon at gentoo dot org Reported By: eromang at zataz dot net Status: Feedback Bug Type: Unknown/Other Function Operating System: UNIX PHP Version: 4.3.11 New Comment: shtool in PHP snapshot is still affected. Note that the proposed patch is probably not sufficient, stay tuned for more. Previous Comments: ------------------------------------------------------------------------ [2005-05-26 14:59:09] tony2001@php.net Please try using this CVS snapshot: http://snaps.php.net/php4-STABLE-latest.tar.gz For Windows: http://snaps.php.net/win32/php4-win32-STABLE-latest.zip ------------------------------------------------------------------------ [2005-05-26 13:56:00] eromang at zataz dot net suggested fix: - tmpfile="$tmpdir/.shtool.$$" - rm -f $tmpfile >/dev/null 2>&1 - touch $tmpfile - chmod 600 $tmpfile + tmpfile=mktemp "$tmpdir/.shtool.XXXXXX" ------------------------------------------------------------------------ [2005-05-26 13:43:40] eromang at zataz dot net Description: ------------ Hello, php is using a vulnerable version of shtool. For more informations : http://www.securityfocus.com/bid/13767?ref=rss Regards ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=33150&edit=1