XBoard < 4.2.7: pxboard insecure tmp file handling
About XBoard:
XBoard is a graphical chessboard that can serve as a user interface
to chess engines (such as GNU Chess), the Internet Chess Servers,
electronic mail correspondence chess, or your own collection of
saved games. pxboard is a script that saves its standard input to
a temporary file and invokes "xboard -loadGameFile file &" on the
file. pxboard is a part of XBoard package. It is not used by default,
only when explicitely called.
More info: http://www.tim-mann.org/xboard.html
The BUG:
pxboard in XBoard 4.2.6 and older creates/writes to a file with
a predictable filename in /tmp directory. In a multiuser environment
malicious user could use this vulnerability to force pxboard user to
overwrite any file she has write access to.
The fix:
1) Upgrade to XBoard 4.2.7
OR
2) Replace pxboard script with the following one:
#!/bin/sh
tmp=`mktemp "${TMPDIR:-/tmp}/pxboard.$$.XXXXXX"` || exit 1
cat > "$tmp"
( xboard -ncp -lgf "$tmp" "$@" ; rm "$tmp" ) &
--
Martin Mačok http://underground.cz/
martin.macok@xxxxxxxxxxxxxx http://Xtrmntr.org/ORBman/