Subject: FVWM: security problem in fvwm2

From: Paul Traina <[email-masked]>
Date: Wed, 12 Jun 1996 22:57:15 -0700 (PDT)

The problem discussed here (originally found in 1.24r) is also in recent
versions of fvwm2 in the modules that do CPP or M4 processing of .fvwm2rc
files.

Since this is a generic problem, I'm notifying you guys of it in hopes that
you'll come up with a fix.  I don't like the fix proposed by the author,
however it certainly works.  I think a better fix would be to fork and
create pipes by hand and use mkstemp to hold temporary information and
avoid the race condition.

Paul

---

From: Austin Donnelly <[email-masked]>
Date: Thu, 13 Jun 96 12:31 BST

> versions of fvwm2 in the modules that do CPP or M4 processing of .fvwm2rc

Yes.

I am the Debian fvwm maintainer, and have given some patches to Chuck
to be put into the next release. I did this almost as soon as
fvwm2-2.0.42 was released, and Chuck is aware of the security problem
(it just that the next beta is still being put together by Chuck).

My original fix for Debian was the less efficient directory creation
based one.  This is the one you have decided to comment on. If you
look at the currect Debian fvwm and fvwm2 packages, you'll see that
they both your the O_EXCL fix, which is far cleaner.

Much better still would be (as you say) to fork off a subprocess and
use pipes. I may well give Chuck a patch for this at some point.

While you're at it, could you please point the BSD people at the
latest Debian fvwm package?  I never thought my nasty directory based
hack would spread this far... :)

Austin
--
Visit the official FVWM web page at <URL:http://www.hpc.uh.edu/fvwm/>.
To unsubscribe from the list, send "unsubscribe fvwm" in the body of a
message to [email-masked].
To report problems, send mail to [email-masked].