CVE-2007-4129: Low severity redhat Enterprise Linux vulnerability

Description of problem: It looks like coolkey creates /tmp/.pk11ipc1 as a world writable directory without the sticky bit. And...it creates the files under that potentially as world writable with the execute bit turned on or uses the file without any sanity check. coolkey runs as root sometimes and that makes it susceptible to doing symlink attacks.

Version-Release number of selected component (if applicable): coolkey-1.1.0-3

How reproducible: always

Steps to Reproduce: 1. ls -la /tmp | grep pk11ipc1

Actual results: drwxrwxrwx 2 root root 4096 2007-08-03 19:57 .pk11ipc1

Expected results: drwxrwxrwt 2 root root 4096 2007-08-03 19:57 .pk11ipc1

Additional info: Will attach a patch that starts to address the problem. But I'd say that after the mkdir, you'd want to opendir and check that the dir has the sticky bit set and set it if not, check that the dir is not a symlink with fstat, then use openat passing that dir fd to it, when the file is open check that its a regular file via fstat, and then use it. You may also want to check the owner ID and file perms too. I'm not sure what this apps really expects, but it needs to be more paranoid about what its opening and using.

— Red Hat