[badpenguin79@hotmail.com: [Full-disclosure] [ZH2005-02SA] Insecure tmp file creation in Wine]

[Peter Bortas]

Alexandre Julliard <julliard at winehq.org> writes:

> Marcus Meissner <meissner at suse.de> writes:
>
>> --- server/registry.c	10 Mar 2005 11:18:31 -0000	1.63
>> +++ server/registry.c	14 Mar 2005 16:38:54 -0000
>> @@ -1610,7 +1610,7 @@
>>      for (;;)
>>      {
>>          sprintf( p, "reg%lx%04x.tmp", (long) getpid(), count++ );
>> -        if ((fd = open( tmp, O_CREAT | O_EXCL | O_WRONLY, 0666 )) != -1) break;
>> +        if ((fd = open( tmp, O_CREAT | O_EXCL | O_WRONLY, 0600 )) != -1) break;
>
> That one is not in /tmp, it's in the user's home directory.

Home directories are group readable on many sites, so to prevent
information leakage 0600 would still be prudent.

-- 
Peter Bortas                  http://peter.bortas.org