Open Etsukata opened 5 years ago
Currently, the default dump file permission is 0666. But there will be no reason to let other users to read or modify dump files.
An attacker could inject some malicious escape sequences into a file, which may be executed on a victim’s terminal emulator (Not Critical).
This PR does not mean the current implementation is vulnerable to symlink attacks. Because the sticky bit is usually set on /tmp and sigdump uses just /tmp (not sub dirs of '/tmp').
/tmp
sigdump
Currently, the default dump file permission is 0666. But there will be no reason to let other users to read or modify dump files.
An attacker could inject some malicious escape sequences into a file, which may be executed on a victim’s terminal emulator (Not Critical).