race condition in servers/slurpd/reject.c function write_reject() (ITS#2009)

[rhafer@suse.de]

Full_Name: Ralf Haferkamp
Version: 2.0.25, HEAD
OS: 
URL: ftp://ftp.openldap.org/incoming/
Submission from: (NULL) (213.95.15.201)


This code contains a race condition

    if ( access( rejfile, F_OK ) < 0 ) {
        /* Doesn't exist - try to create */
        int rjfd;
        if (( rjfd = open( rejfile, O_RDWR | O_APPEND | O_CREAT,
                S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP )) < 0 ) {

The file could have been created between access() and open() (e.g. symlink
attack). open should use "O_EXCL".