Re: strange things plugins

On Mon, Jan 03, 2005 at 10:26:55AM +0100, Pavel Kankovsky wrote:
> > > rand() is not a safe way to make temporary filenames.
> > 
> > Who cares ? The temporary files are created in a protected directory
> > that only root can write in.
> 
> 1. Are you sure two concurrently running scripts cannot pick the same
>    temporary filename? (This leads to a related and quite interesting
>    question of the behaviour of nasl_rand() in forked processes...)

nasl_rand() is seeded differently for each process. There's no real
garantee that two scripts can't pick the same name, but that would be
quite unlikely (but that has no real security implication anyway). 
I'll harden this, though.

> 2. It might fail back to /tmp when a private directory is unavailable.

I was not aware of that (and that does not make me too happy). I've
removed that piece of code. It should be noted that it falls back to
/tmp ONLY if the Nessus installation is broken.

> > > pread() arguments with embedded apostrophes or quotation marks in 
> > > ssh_get_info.nasl look suspicious.
> > 
> > I could not find any occurence where the quotes where used
> > inappropriately. The arguments to the 'rpm' commands are ok and do
> > contain quotes on purpose.
> 
> Try
> 	pread(cmd:"echo", argv:make_list("'a'"))
> and
> 	ssh_cmd(socket:sock, cmd:"echo 'a'")
> 
> Are the results identical?

Aaah - my bad. Fixed, thanks !


				-- Renaud
_______________________________________________
Nessus-devel mailing list
[email protected]
http://mail.nessus.org/mailman/listinfo/nessus-devel