Re: [hacksware]Pine temporary file hijacking vulnerability

[Thomas Corriher <corriher () bellsouth net>]

So many of these problems would just disappear if the
system's default profile had something like "$TMPDIR=$HOME"
or "$TMPDIR=$HOME/tmp".  Pine is not really the problem.
Poorly configured systems are the problem.  Linux
distributors: are you paying attention?  Why should all
users be given full access to any directory; especially if
most programs are designed to use that directory by default?
It is time that we wake up certain corporations and software
distribution companies.  This sloppiness should not be
tolerated.

This type of problem appears again, and again, and again; yet
these problems could be fixed with a one-liner.  Oh the insanity!

I am not even an expert on security matters, but I do know enough
about the basics to realize that many default configurations are
incredibly stupid.


--
  From the desk of Thomas Corriher
  Sent via Red Hat Linux
  Phone: +1-704-921-2470