Bug 112468 - Temporary files are world writeable
Temporary files are world writeable
Status: CLOSED DUPLICATE of bug 39685
Product: Red Hat Linux
Classification: Retired
Component: imap (Show other bugs)
9
i386 Linux
medium Severity medium
: ---
: ---
Assigned To: John Dennis
David Lawrence
: Security
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2003-12-20 04:28 EST by Andrew E. Mileski
Modified: 2007-04-18 13:00 EDT (History)
1 user (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2006-02-21 14:00:29 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Andrew E. Mileski 2003-12-20 04:28:51 EST
# ls -al /tmp
total 20
drwxrwxrwt    3 root     root         4096 Dec 20 04:20 .
drwxr-xr-x   20 root     root         4096 Nov 14 05:09 ..
-rw-rw-rw-    1 andrewm  andrewm         5 Dec 20 04:18 .303.401f
# cat .303.401f
18837# ps 18837
  PID TTY      STAT   TIME COMMAND
18837 ?        S      0:00 imapd


Version-Release number of selected component (if applicable):
imap-2001a-18

How reproducible:
Always

Steps to Reproduce:
1. Connect to server via IMAP
    
Additional info:
The umask for root and the user are both set to 077 in their .bashrc
Comment 1 Mike A. Harris 2004-02-27 05:23:27 EST
Yep, this security flaw is inherent in the design of UW imap,
and is covered in the UW imap FAQ.  The UW people believe that
this isn't an issue at all, and they refuse to address it.

Fixing the problem essentially means forking the UW imap
codebase, and maintaining our own fork which is incompatible
with all other OS vendors.  We have decided to replace UW imap
with alternative software in future OS releases instead, due
to the large number of security problems in the UW imap software,
and frequent security vulnerabilities.
Comment 2 Mike A. Harris 2004-02-27 05:30:00 EST

*** This bug has been marked as a duplicate of 39685 ***
Comment 3 Red Hat Bugzilla 2006-02-21 14:00:29 EST
Changed to 'CLOSED' state since 'RESOLVED' has been deprecated.

Note You need to log in before you can comment on or make changes to this bug.