mailing list archives
Re: mpack 1.6 allows eavesdropping on mails sent by other users
From: Sebastian Pipping <sebastian () pipping org>
Date: Thu, 19 Jan 2012 07:32:26 +0100
On 12/31/2011 08:39 PM, Sebastian Pipping wrote:
A patch could be to change create files with 0600 permissions rather
than 0644 as done by . However, that approach affects creation of
non-temporary files too. In some cases, users may not want that
behaviour -- you tell me.
There now is a patch in addition to  that people seeking to fix the
described issue may be interested in.
Dirk Meyer of FreeBSD brought my attention to a broken case with munpack
that was shipped broken with the original 1.6 upstream tarball but may
have been fixed by the removal of O_EXCL applied by earlier attempts to
fix the insecure tempfile handling (as with FreeBSD).
So with O_EXCL back in (or still in place), patch  can be used to