Wikipedia

Time-of-check to time-of-use: Difference between revisions

Browse history interactively
← Previous editNext edit →
Content deleted Content added
VisualWikitext
Citation bot (talk | contribs)
Bots
5,865,659 edits
m Alter: template type. Add: citeseerx, journal. Removed URL that duplicated unique identifier. Removed parameters. Some additions/deletions were actually parameter name changes. | You can use this bot yourself. Report bugs here. | Activated by User:AManWithNoPlan | via #UCB_webform
m Task 70: Update syntaxhighlight tags - remove use of deprecated <source> tags
Line 7:
 
In [[Unix]], the following [[C (programming language)|C]] code, when used in a <code>[[setuid]]</code> program, has a TOCTOU bug:
<sourcesyntaxhighlight lang="c">
if (access("file", W_OK) != 0) {
exit(1);
Line 14:
fd = open("file", O_WRONLY);
write(fd, buffer, sizeof(buffer));
</syntaxhighlight>
</source>
 
Here, ''access'' is intended to check whether the real user who executed the <code>setuid</code> program would normally be allowed to write the file (i.e., <code>''access''</code> checks the [[real userid]] rather than [[effective userid]]).
Line 24:
|Attacker
|-
|<sourcesyntaxhighlight lang="c">
if (access("file", W_OK) != 0) {
exit(1);
Line 32:
// Actually writing over /etc/passwd
write(fd, buffer, sizeof(buffer));
</syntaxhighlight>
</source>
||
<sourcesyntaxhighlight lang="c">
//
//
Line 42:
//
//
</syntaxhighlight>
</source>
|}
 
Retrieved from "https://en.wikipedia.org/wiki/Time-of-check_to_time-of-use"