Subject: xsrc/32805: file creation race condition in Xsession in xsrc, xorg
To: None <xsrc-manager@netbsd.org, gnats-admin@netbsd.org,>
From: None <smb@cs.columbia.edu>
List: netbsd-bugs
Date: 02/12/2006 15:05:00 
>Number:         32805
>Category:       xsrc
>Synopsis:       there's a /tmp file creation race condition in Xsession
>Confidential:   no
>Severity:       serious
>Priority:       low
>Responsible:    xsrc-manager
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sun Feb 12 15:05:00 +0000 2006
>Originator:     Steven M. Bellovin
>Release:        NetBSD 3.99.15
>Organization:
>Environment:
	
	
System: NetBSD bigboy.machshav.com 3.99.15 NetBSD 3.99.15 (BIGBOY) #0: Fri Feb 10 08:50:25 EST 2006 smb@bigboy.machshav.com:/usr/BUILD/obj/sys/arch/i386/compile/BIGBOY i386
Architecture: i386
Machine: i386
>Description:
	Xsession tries to create a log file; among the possiblities are
	/tmp/xses-$USER.  But an attacker could create a symlink of
	that name pointing somewhere else.  Normally, this would be
	a very serious error; however, most of the time it will succeed
	in creating $HOME/.xsession-errors and not try /tmp.

	The problem is in both xsrc and xorg.
>How-To-Repeat:
	See above.
>Fix:
	Use mktemp instead.

>Unformatted: