From 6ba44b91e37622ef8c146d8f2ac92d708a18ed34 Mon Sep 17 00:00:00 2001 From: Matthieu Herrb <matthieu.herrb@laas.fr> Date: Mon, 17 Oct 2011 20:26:12 +0000 Subject: Fix CVE-2011-4028: File disclosure vulnerability. use O_NOFOLLOW to open the existing lock file, so symbolic links aren't followed, thus avoid revealing if it point to an existing file. Signed-off-by: Matthieu Herrb <matthieu.herrb@laas.fr> Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com> --- diff --git a/os/utils.c b/os/utils.c index e8ecb71..fe49254 100644 --- a/os/utils.c +++ b/os/utils.c @@ -318,7 +318,7 @@ LockServer(void) /* * Read the pid from the existing file */ - lfd = open(LockFile, O_RDONLY); + lfd = open(LockFile, O_RDONLY|O_NOFOLLOW); if (lfd < 0) { unlink(tmp); FatalError("Can't read lock file %s\n", LockFile); -- cgit v0.9.0.2-2-gbebe