Re: ACT announces availability of GNAT 3.14p

[Florian Weimer <fw@deneb.enyo.de>]

dewar@gnat.com (Robert Dewar) writes:

> We are of course aware of this bug report which was retired
> some time ago (but after 3.14p was frozen), but "security
> defect" is rather extreme considering how this is used. 
> You can always use scary language like this to talk about
> anything, but it is a bit over the top in this case!

No, it isn't.

/tmp is shared on multi-user UNIX systems, and if a malicious local
user creates a symbolic link with a suitable name at the right time,
the output which is supposed to be written into a newly-created
temporary file is redirected to a different file instead, which can
have devastating effects (suppose that /etc/passwd is overwritten, for
example).

For many different pieces of software, it has been demonstrated over
and over again that such attacks are indeed possible, so this is not
just a theoretical issue.  (BTW, this is also true for the buffer
overflow bug in the current FSF sources I reported for the second or
third time.)

A random sample of similar problems:

http://www.kb.cert.org/vuls/id/426273
http://www.kb.cert.org/vuls/id/626919
http://www.cert.org/vendor_bulletins/VB-97.05.lynx
http://www.ciac.org/ciac/bulletins/l-084.shtml
http://www.securityfocus.com/bid/3135
http://www.securiteam.com/unixfocus/5XP0M2A4BU.html
http://cert.uni-stuttgart.de/archive/win-sec-ssc/2000/09/msg00012.html
http://www.insecure.org/sploits/sam.hpux.race.html

> And if you think there is a "security defect" in the current version
> (I disagree), you should report it (to
> GNATS or report@gnat.com).

I have nothing to add to the old bug report.  I think it contains all
the relevant information.