Re: [Gnash-commit] [SCM] Gnash branch, master, updated. release_0_8_9_final-1227-gfa481c1

[Sandro Santilli]

On Mon, Nov 21, 2011 at 09:08:19AM +0100, Benjamin Wolsey wrote:
>  
> >      cookiefile.open(ss.str().c_str(), std::ios::out | std::ios::trunc);
> > +    chmod (ss.str().c_str(), 0600);
> 
> There's still the possibility of an attacker opening the file between 
> creation and the chmod call. Calling umask() before opening the file should 
> avoid that problem. As umask() sets the permissions mask for the current 
> process only, the only problem is calling it from more than one thread.

That's what I suggested as well.
I don't really see a reason why not setting umask before any threads start.

Beside, another security hole has been reported as being the opening/truncation
itself of cookiefile whereas this could be a symlink to a  file with valuable
informations. Should be inspected and secured.

--strk; 

  ()   Free GIS & Flash consultant/developer
  /\   http://strk.keybit.net/services.html