OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Bugtraq archives for 4th quarter (Oct-Dec) 1994: Re: access(2)--a security hole?

Re: access(2)--a security hole?

Howie Kaye (howiecolumbia.edu)
Fri, 21 Oct 94 11:03:14 EDT 

The security hole in access() is really that it has an implicit race
condition in it.  You check a file, and then you assume moments later that
the same access is granted.  So, if the file is a really a symlink, and
someone changes where it points to between the access() and the open(), a
completely different file might be affected.  This is the root of many of
the holes that get posted here (xterm, /bin/mail come to mind).

------------------------------------------------------------
Howie Kaye				howiecolumbia.edu
Columbia University 			hlkcucuvma.bitnet
UNIX Systems Group			...!rutgers!columbia!howie