===================================================================
RCS file: /cvsrepo/anoncvs/cvs/www/Attic/porting.html,v
retrieving revision 1.15
retrieving revision 1.16
diff -c -r1.15 -r1.16
*** www/Attic/porting.html	1998/12/20 17:08:45	1.15
--- www/Attic/porting.html	1998/12/21 21:48:41	1.16
***************
*** 95,107 ****
         <code>strcat/strcpy/strcmp/sprintf</code>.  In general,
         <code>sprintf</code> should be replaced with <code>snprintf</code>.
  
!    <li>Never use filenames when you need security.   There are numerous race
         conditions where you don't have proper control. For instance, an attacker
         who already has user privileges on your machines may replace files in 
         <code>/tmp</code> with symbolic links to more strategic files, such as
         <code>/etc/passwd</code>.  
                   
!    <li>For instance, one very common problem is the <code>mktemp</code>
         function. Head the warnings of the bsd linker about its uses.  
         <strong>These must be fixed</strong>.
         This is not quite as simple as <code>s/mktemp/mkstemp/g</code>.  <br>
--- 95,116 ----
         <code>strcat/strcpy/strcmp/sprintf</code>.  In general,
         <code>sprintf</code> should be replaced with <code>snprintf</code>.
  
!    <li>Never use filenames insteaad of true security. There are numerous race
         conditions where you don't have proper control. For instance, an attacker
         who already has user privileges on your machines may replace files in 
         <code>/tmp</code> with symbolic links to more strategic files, such as
         <code>/etc/passwd</code>.  
+ 
+    <li>For instance, both <code>fopen</code> and <code>freopen</code>
+        <strong>create a new file or open an existing file</strong> for
+        writing. An attacker may create a symbolic link from
+        <code>/etc/paswd</code> to <code>/tmp/addrpool_dump</code>. The
+        instant you open it, your password file is hosed. Yes, even with
+        an <code>unlink</code> right before. You only narrow the window
+        of opportunity.  Use <code>open</code> with
+        <code>O_CREAT|O_EXCLUDE</code> and <code>fdopen</code> instead.
                   
!    <li>Another very common problem is the <code>mktemp</code>
         function. Head the warnings of the bsd linker about its uses.  
         <strong>These must be fixed</strong>.
         This is not quite as simple as <code>s/mktemp/mkstemp/g</code>.  <br>
***************
*** 332,337 ****
    <hr>
    <a href="index.html"><img height=24 width=24 src=back.gif border=0 alt=OpenBSD></a> 
    <a href=mailto:www@openbsd.org>www@openbsd.org</a>
!   <br><small>$OpenBSD: porting.html,v 1.15 1998/12/20 17:08:45 espie Exp $</small>
   </body>
  </html>
--- 341,346 ----
    <hr>
    <a href="index.html"><img height=24 width=24 src=back.gif border=0 alt=OpenBSD></a> 
    <a href=mailto:www@openbsd.org>www@openbsd.org</a>
!   <br><small>$OpenBSD: porting.html,v 1.16 1998/12/21 21:48:41 espie Exp $</small>
   </body>
  </html>