Programming Perl, 4th Edition

Temporary Files

Apart from allowing buffer overruns (which Perl scripts are virtually immune to) and trusting untrustworthy input data (which taint mode guards against), creating temporary files improperly is one of the most frequently exploited security holes. Fortunately, temp file attacks usually require crackers to have a valid user account on the system they’re trying to crack, which drastically reduces the number of potential bad guys.

Careless or casual programs use temporary files in all kinds of unsafe ways, like placing them in world-writable directories, using predictable filenames, and not making sure the file doesn’t already exist. Whenever you find a program with code like this:

open(TMP, "> /tmp/foo.$$")
    || die "can't open /tmp/foo.$$: $!";

you’ve just found all three of those errors at once. That program is an accident waiting to happen.

The way the exploit plays out is that the cracker first plants a file with the same name as the one you’ll use. Appending the PID isn’t enough for uniqueness; surprising though it may sound, guessing PIDs really isn’t difficult.^[199] Now along comes the program with the careless open call, and instead of creating a new temporary file for its own purposes, it overwrites the cracker’s file instead.

So what harm can that do? A lot. The cracker’s file isn’t really a plain file, you see. It’s a symbolic link (or sometimes a hard link), probably pointing to some critical file that crackers couldn’t normally write to on their own, such as