• info
• discussion
• exploit
• solution
• references

XFree86 4.0.1 /tmp Vulnerabilities

Exploits for these programs require being able to predict the temporary filename. From this follows the normal array of /tmp race condition tricks.