On Fri, 11 May 2018 00:08:52 +0200, Martin Burmester wrote: > /tmp is a bad place for the srsd socket. Unfortunately that pathname is > hardcoded (/usr/bin/srsd, line 15). It is probably not an exploitable > insecure tempfile creation, nonetheless it should not be there.
And in some other places, in case we want to add a patch:
% grep -r /tmp/srsd
eg/exim/srs.conf: address_data = ${readsocket{/tmp/srsd}\
eg/exim/srs.conf: address_data = ${readsocket{/tmp/srsd}\
eg/exim/srs.conf:#^(?i:srs0[-+=]) ${readsocket{/tmp/srsd}{REVERSE
$0\n}{5s}{\n}\
eg/exim/srs.conf:#^(?i:srs1[-+=]) ${readsocket{/tmp/srsd}{REVERSE
$0\n}{5s}{\n}\
eg/exim/srs.conf:#* ${readsocket{/tmp/srsd}{FORWARD
$0 SRSDOMAIN}{5s}{\n}\
lib/Mail/SRS/Daemon.pm:$SRSSOCKET = '/tmp/srsd';
srsd:$PATH = '/tmp/srsd';
Cheers,
gregor
--
.''`. https://info.comodo.priv.at -- Debian Developer https://www.debian.org
: :' : OpenPGP fingerprint D1E1 316E 93A7 60A8 104D 85FA BB3A 6801 8649 AA06
`. `' Member VIBE!AT & SPI Inc. -- Supporter Free Software Foundation Europe
`- NP: Element of Crime: Finger weg von meiner Paranoia
signature.asc
Description: Digital Signature
