From e5c5f0191d29e4867be7a29b5ebfe8f91863a7e2 Mon Sep 17 00:00:00 2001 From: Gerard Beekmans Date: Tue, 4 Feb 2003 02:56:15 +0000 Subject: [PATCH] updated ed patch explanation git-svn-id: http://svn.linuxfromscratch.org/LFS/trunk/BOOK@2421 4aa44e1e-78dd-0310-a6d2-fbcd4c07a689 --- chapter06/ed-inst.xml | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/chapter06/ed-inst.xml b/chapter06/ed-inst.xml index 093273360..fa2e62e03 100644 --- a/chapter06/ed-inst.xml +++ b/chapter06/ed-inst.xml @@ -8,13 +8,12 @@ because it can be used by the patch program if you encounter an ed-based patch file. This happens rarely because diff-based patches are preferred these days. -This package requires its patch to be applied before you can -install it. This patch fixes a symlink vulnerability in -ed. The ed executable -creates files in /tmp with -predictable names. By using various symlink attacks, it is possible -to have ed write to files it should not, change the permissions of -files, etc. +Ed uses mktemp to create temporary files in /tmp, but this function has a security +vulnerability (see section on Temporary Files in +). +This patch makes Ed use mkstemp instead, which is the recommended way to +create temporary files. Apply the patch: