Re: ✘gpsd release coming

[Bernd Zeimetz]

On 8/4/20 6:33 PM, Gary E. Miller wrote:
> The algo is:
> 
> Check in GPSD_HOME
> 
> Check in current working directory

This is a security risks, unless you add at least some extra
measurements by checking if at least the owner is the same user as the
one who is running the process at the moment.

I think I've mentioned it before that loading things from the cwd is a
bad bad idea in general.
What you could do is to use the directory of the binary/script you are
running.

Otherwise some evil guy could talk root into runinng gpscat or whatever
in /tmp, while having an enhanced libgpsdpacket lying around there.

Such things are worth a cve.


Bernd

-- 
 Bernd Zeimetz                            Debian GNU/Linux Developer
 http://bzed.de                                http://www.debian.org
 GPG Fingerprint: ECA1 E3F2 8E11 2432 D485  DD95 EB36 171A 6FF9 435F