[DebianGIS-dev] Bug#508595: CVE-2008-5380: allows local users to overwrite arbitrary files via a symlink attack

[Hamish]

note these helper scripts are not a core part of running the program.

$ grep /tmp/ *
geo-code:TMP=/tmp/geo$$
geo-code:               cp $COORDS /tmp/geo.google
geo-code:    filter="tee /tmp/geo.yahoo"
geo-code:       cp $COORDS /tmp/geo.coords
geo-nearest:    TMP=/tmp/geo
geo-nearest:    TMP=/tmp/geo$$
geo-nearest:    cp $GEOWAY /tmp/geocaching.loc
gpssmswatch:FILE=/tmp/.smswatch
gpssmswatch:NUMBER=`grep Sender /tmp/.smswatch|awk '{print $2}'`
gpssmswatch:cat /tmp/gpsdrivepos
gpssmswatch:gnokii --sendsms $NUMBER < /tmp/gpsdrivepos


these three are all shell/bash scripts.

possible fix:

TMP=`tempfile -p geo.`
if [ $? -ne 0 ] || [ -z "$TMP" ] ; then
    echo "ERROR: Unable to create temporary files" 1>&2
    exit 1
fi


see also comments here:
 http://sourceforge.net/tracker/index.php?func=detail&aid=2121124&group_id=148048&atid=770280


Hamish