Bugtraq: Wietse's RPCBIND

[wietse () PORCUPINE ORG (Wietse Venema)]

"My" rpcbind (which is mostly SUN code) does:

        unlink(savefile);
        fopen(savefile);

Thus, the time window is small. Moreover, you get only one chance;
once rpcbind is gone, someone has to restart it by hand. I figure
that if you slow down the file system enough, and fill up the open
file table, there will be a way to sneak in.

The fix is to open the save file with the O_EXCL flag set. I'm
about to leave for a week. I'll see if I can get out an update
today, otherwise it will have to be a week later.

        Wietse