Re: insecure file handling in geoip package
Anatoly Pugachev <[email protected]> Tue, 6 Apr 2010 13:48:46 +0400
| Newsgroups | gmane.os.freebsd.bugbusters |
|---|---|
| Message-ID | <[email protected]> |
Just submitted via http://www.freebsd.org/send-pr.html web-form. Thanks. On Mon, Apr 5, 2010 at 6:24 PM, <[email protected]> wrote: > On Mon, 5 Apr 2010, Anatoly Pugachev wrote: > >> Can you please update file /usr/local/bin/geoipupdate.sh >> in GeoIP freebsd package to handle downloaded file in a more secure >> manner, i.e. with using mktemp: >> >> #!/bin/sh >> TMPFILE=`mktemp /tmp/geoip.XXXXXX` || exit 1 >> fetch -o $TMPFILE >> http://64.246.48.99/download/geoip/database/GeoLiteCountry/GeoIP.dat.gz >> gzip -dc $TMPFILE > /usr/local/share/GeoIP/GeoIP.dat >> rm $TMPFILE >> >> Since this shell script is usually put in cron with root account, attacker >> can use unix-symlink attack. Thanks. > > Hi, > > Are you able to submit a PR about this? If there's some reason you can't, > let me know and I'll submit one for you. Please also include in the PR > subject the full port name (is this related to the net/GeoIP port, or one of > the other possible geoip ports?). If you can't submit a PR, let me know > which port it relates to and I'll submit the details. _______________________________________________ [email protected] mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-bugbusters To unsubscribe, send any mail to "[email protected]"