Re: Temporary File Creation Bug

Hi Hubert,

Hubert Chan wrote:

> Cc-ing Rexotec, since they are the ones who discovered this.
>
> Looking at the original message [1], I think this has all been fixed in
> my patches [2] (20-logdirectory.diff and 50-nonodestmp.diff).  At least,
> my patches:
>   - move the openmosixcollector files to /var/lib/openmosixcollector,
>     which can be made to be writable only by root
>   - don't use /tmp/nodes.tmp


:) yep, i think so too. thanks again for those fixes.

btw: i just added the link to your patches-page to the 
openMosixview-download page in a more "public" place.

all the best,

Matt

>
> Can someone from Rexotec confirm that this fixes the issue?
>
> *smacking myself for not noticing earlier that this was a security issue*
>
> [1] http://www.securityfocus.com/archive/1/394282
> [2] http://uw-dig.uwaterloo.ca/~hy3chan/patches/openmosixview/1.5/
>
> Niels do Vos wrote:
>
>> For the users of openMosixView:
>>        The vulnerability is not very severe. No need to stress, disable
>>        openMosixView or anything like that. Only local users _could_
>>        exploid this bug. As long as your users of the cluster behave,
>>        you're not in trouble. 
>
>
> Don't trust your local users.
>



-------------------------------------------------------
This SF.net email is sponsored by Demarc:
A global provider of Threat Management Solutions.
Download our HomeAdmin security software for free today!
http://www.demarc.com/info/Sentarus/hamr30