Re: race condition in servers/slurpd/reject.c function write_reject() (ITS#2009)

[Kurt@OpenLDAP.org]

Fixed in HEAD.

At 09:43 AM 2002-08-05, rhafer@suse.de wrote:
>Full_Name: Ralf Haferkamp
>Version: 2.0.25, HEAD
>OS: 
>URL: ftp://ftp.openldap.org/incoming/
>Submission from: (NULL) (213.95.15.201)
>
>
>This code contains a race condition
>
>    if ( access( rejfile, F_OK ) < 0 ) {
>        /* Doesn't exist - try to create */
>        int rjfd;
>        if (( rjfd = open( rejfile, O_RDWR | O_APPEND | O_CREAT,
>                S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP )) < 0 ) {
>
>The file could have been created between access() and open() (e.g. symlink
>attack). open should use "O_EXCL".