Re: Security vulnerability in automake

[Lawrence Teo]

> > Likewise, having a "hardened" config.guess file would not necessarily
> > prevent symlink attacks, but it'll definitely make it much harder for an
> > attacker to exploit it, even if the admin is sloppy.
>
> An attacker is hardly likely to distribute a "hardened" config.guess

Of course the attacker won't distribute a hardened config.guess. But look at 
my attack example shown in my reply to Allan's mail:

http://mail.gnu.org/pipermail/automake/2002-June/011190.html

That attack does *not* require an attacker to distribute a hardened 
config.guess, or change the original source code of the package in any way.

Lawrence

_________________________________________________________________
Chat with friends online, try MSN Messenger: http://messenger.msn.com