insecure file handling in geoip package

Anatoly Pugachev <[email protected]> Mon, 5 Apr 2010 11:54:37 +0400
Newsgroups gmane.os.freebsd.bugbusters
Message-ID <[email protected]>
Hello!

Can you please update file /usr/local/bin/geoipupdate.sh
in GeoIP freebsd package to handle downloaded file in a more secure
manner, i.e. with using mktemp:

#!/bin/sh
TMPFILE=`mktemp /tmp/geoip.XXXXXX` || exit 1
fetch -o $TMPFILE http://64.246.48.99/download/geoip/database/GeoLiteCountry/GeoIP.dat.gz
gzip -dc $TMPFILE > /usr/local/share/GeoIP/GeoIP.dat
rm $TMPFILE

Since this shell script is usually put in cron with root account, attacker
can use unix-symlink attack. Thanks.

_______________________________________________
[email protected] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-bugbusters
To unsubscribe, send any mail to "[email protected]"