--==_Exmh_-2056590168P
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: quoted-printable

On Mon, 16 Feb 2004 16:49:53 +0100, "Dr. Peter Bieringer" said:

> logfile=3D/tmp/LiveUpdate.log <---!!!!!!
> =

> Impact:
> Before first run of LiveUpdate (like suggested in doc, user "symantec" =
does =

> this) a possible race condition via a symlink attack by another user wi=
ll =

> result in the creation of a new file (as user "symantec") or appending =

> LiveUpdate log to an existent file (owned by user "symantec").

For bonus points, figure out what happens if you reboot and your /etc/fst=
ab has this:

none /tmp tmpfs mode=3D1777 0 0

The gift that keeps on giving.

--==_Exmh_-2056590168P
Content-Type: application/pgp-signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (GNU/Linux)
Comment: Exmh version 2.5 07/13/2001

iD8DBQFAMO4TcC3lWbTT17ARArQFAJ9nPyvuisTKJQZJz9wZCF mzRFIvvgCgs7yW
ofaPmjFeOFlxFZcxUus75bA=
=dB3Z
-----END PGP SIGNATURE-----

--==_Exmh_-2056590168P--