Bugtraq mailing list archives

/tmp issue with savetextmode

From: mspencer () ENG AUBURN EDU (Mark A. Spencer)
Date: Mon, 23 Mar 1998 12:39:06 -0600


The "savetextmode" command (a script typically run by root) writes to
/tmp/textregs and /tmp/fontdata without any checks and will happily
clobber stuff.

Moreover, the programs which actually do the writing (restoretextmode and
restorefont) are sometimes setuid root on older linux systems...

I have notified RedHat but have not yet heard a response (in 3 days) so I
felt it appropriate to post.

                                        -Mark

Current thread:

/tmp issue with savetextmode Mark A. Spencer (Mar 23)