IRIX MIPSPro Compiler /tmp Filename Predictability Vulnerability

A vulnerability exists in the creation of temporary files, in the MIPSpro compiler suite from SGI. The C, C++, Fortran 77 and Fortran 90 compilers each create predictably named files in /tmp, with the permissions specified by the umask of the user running the compiler. As these are predictable, it makes it fairly easy for a malicious user to alter the contents of these files, in order to potentially execute code under the ID of the user compiling.


 

Privacy Statement
Copyright 2010, SecurityFocus