Speech Dispatcher 0.7 Beta -- Please help with testing

trev.saunders at gmail.com trev.saunders at gmail.com
Tue Apr 27 19:30:39 BST 2010


HI,

THere is a rather large local security problem with your use of unix sockets.  It is very easy for a local hostile user to cause a denial of service, because you put the unix sockets in a world readable place with *very* predictable names.  They are so predictable because a the only thing that the attacker has to gues is the UID of the user, and because UID's for standard users start at 1000, and are assigned in order, the attacker would only have to create say 100 files, wich with a simple shell script is trivial.

Trev



More information about the Ubuntu-accessibility mailing list