[Radiance-dev] Security issue - Insecure use of files in /tmp

[Bernd Zeimetz]

Hi,

unfortunately I got a bug report about insecure handling of temp files
in Radiance:

radiance_3R9+20080530-3 dayfact     /tmp/gsf$$ (pipe)
                                    /tmp/tl$$.pic (pipe)
                                    /tmp/ds$$.pic (pipe)
                                    /tmp/tfa$$ (pipe)
                        optics2rad  /tmp/opt.fmt (pipe)
                                    /tmp/out$$.fmt (pipe)
                        raddepend   /tmp/sed$$ (pipe)

Temp files need to be created with a non-predictable way, otherwise
other users could create a link or file with the same name to trick you
into overwriting files, which could (in the worse case) result into a
compromise of the system.
In case you know about similar problems in other scripts or even in the
C code, please let me know, so they can be fixed, too.
Regarding Debian, such bugs are considered 'grave'. I'll have to upload
a fix soon for Lenny, otherwise the package will be removed.


Best regards,

Bernd

-- 
 Bernd Zeimetz                           Debian GNU/Linux Developer
 GPG Fingerprint: 06C8 C9A2 EAAD E37E 5B2C BE93 067A AD04 C93B FF79