OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
From: Darren Moffat (Darren.Moffateng.sun.com)
Date: Wed Aug 22 2001 - 12:35:07 CDT

  • Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

    >Adobe Acrobat creates world writable ~/AdobeFnt.lst files
    >
    >This problem is present in at least the Linux version:
    >ftp://ftp.adobe.com/pub/adobe/acrobatreader/unix/4.x/linux-ar-405.tar.gz
    >
    >Even with umask as restrictive as 077, the Adobe binary explicitly
    >creates and changes the AdobeFnt.lst file in the HOME directory to be
    >world (and group) writable.

    What anoys me almost as much as ignoring the umask is that this file
    is placed directly into $HOME and isn't a "." file.

    >Vendor notified: on or before 2001-03-02

    I notified Adobe of this on October 27th 1999 and never got any reply,
    see attached.

    Another possible workaround would be to create a shared object that
    replaced the open/chmod calls that change the permissions on the file,
    this could then be LD_PRELOAD'd so that acroread doesn't do the wrong thing.

    Using truss on Solaris we can easily see that acroread actually makes
    an explicit call to set the permissions to 0666.

    251032: open("/home/darrenm/AdobeFnt.lst", O_WRONLY|O_CREAT|O_TRUNC, 01) = 6
    251032: fchmod(6, 0666)

    --
    Darren J Moffat
    

    ------------- Begin Included Message -------------