From 6ba44b91e37622ef8c146d8f2ac92d708a18ed34 Mon Sep 17 00:00:00 2001 From: Matthieu Herrb Date: Mon, 17 Oct 2011 22:26:12 +0200 Subject: [PATCH 1/2] Fix CVE-2011-4028: File disclosure vulnerability. use O_NOFOLLOW to open the existing lock file, so symbolic links aren't followed, thus avoid revealing if it point to an existing file. Signed-off-by: Matthieu Herrb Reviewed-by: Alan Coopersmith --- os/utils.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/os/utils.c b/os/utils.c index e8ecb7193..fe4925497 100644 --- a/os/utils.c +++ b/os/utils.c @@ -318,7 +318,7 @@ LockServer(void) /* * Read the pid from the existing file */ - lfd = open(LockFile, O_RDONLY); + lfd = open(LockFile, O_RDONLY|O_NOFOLLOW); if (lfd < 0) { unlink(tmp); FatalError("Can't read lock file %s\n", LockFile); From b67581cf825940fdf52bf2e0af4330e695d724a4 Mon Sep 17 00:00:00 2001 From: Matthieu Herrb Date: Mon, 17 Oct 2011 22:27:35 +0200 Subject: [PATCH 2/2] Fix CVE-2011-4029: File permission change vulnerability. Use fchmod() to change permissions of the lock file instead of chmod(), thus avoid the race that can be exploited to set a symbolic link to any file or directory in the system. Signed-off-by: Matthieu Herrb Reviewed-by: Alan Coopersmith --- os/utils.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/os/utils.c b/os/utils.c index fe4925497..07cf4c24f 100644 --- a/os/utils.c +++ b/os/utils.c @@ -297,7 +297,7 @@ LockServer(void) FatalError("Could not create lock file in %s\n", tmp); (void) sprintf(pid_str, "%10ld\n", (long)getpid()); (void) write(lfd, pid_str, 11); - (void) chmod(tmp, 0444); + (void) fchmod(lfd, 0444); (void) close(lfd); /*