How to Open a File and Not Get Hacked

13 years 10 months ago

Download www.cs.wisc.edu

Careless attention to opening ﬁles, often caused by problems with path traversal or shared directories, can expose applications to attacks on the ﬁle names that they use. In this paper we present criteria to determine if a path is safe from attack and how previous algorithms are not sufﬁcient to protect against such attacks. We then describe an algorithm to safely open a ﬁle when in the presence of an attack (and how to detect the presence of such an attack), and provide a new library of ﬁle open routines that embodies our algorithm. These routines can be used as one-for-one substitutes for conventional POSIX open and fopen calls.

James A. Kupsch, Barton P. Miller

Real-time Traffic