Scott James Remnant <scott@netsplit.com>

* m4/ltmain.in: Don't use the mkdir -p option when creating a
temporary output directory so a symlink attack can't be used to
arbitrarily chmod other directories on the system if libtool
gets run as root.

diff --git a/ChangeLog b/ChangeLog
index cecf1b02b3e20cf8cc7f472d5e232baa4e7bc463..5f8797708475d063500b0127812bbfc69824cda7 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,11 @@
+2004-01-03  Stefan Nordhausen  <nordhaus@informatik.hu-berlin.de>
+       Scott James Remnant  <scott@netsplit.com>
+
+       * m4/ltmain.in: Don't use the mkdir -p option when creating a
+       temporary output directory so a symlink attack can't be used to
+       arbitrarily chmod other directories on the system if libtool
+       gets run as root.
+
 2004-01-02  Peter O'Gorman  <peter@pogma.com>
 
        * m4/libtool.m4: Ensure that ${ZSH_VERSION+set} is properly escaped.

diff --git a/ltmain.in b/ltmain.in
index edc9f8fe6f0e46d794d765ab32d09aff51279439..aee690b59978e0e1570ab4dbd0e02954db91fd34 100644 (file)
--- a/ltmain.in
+++ b/ltmain.in
@@ -5857,7 +5857,7 @@ relink_command=\"$relink_command\""
              tmpdir="/tmp"
              test -n "$TMPDIR" && tmpdir="$TMPDIR"
              tmpdir="$tmpdir/libtool-$$"
-             if $mkdir -p "$tmpdir" && chmod 700 "$tmpdir"; then :
+             if $mkdir "$tmpdir" && chmod 700 "$tmpdir"; then :
              else
                $echo "$modename: error: cannot create temporary directory \`$tmpdir'" 1>&2
                continue