Difference between revisions of "Guessed or visible temporary file"

Jump to: navigation, search
(One intermediate revision by the same user not shown)
Line 1: Line 1:
[[ASDR Table of Contents]]
Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''
Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''
[[Category:FIXME|This is the text from the old template. This needs to be rewritten using the new template.]]
[[ASDR_TOC_Vulnerabilities|Vulnerabilities Table of Contents]]

Latest revision as of 20:12, 20 February 2009

This is a Vulnerability. To view all vulnerabilities, please see the Vulnerability Category page.

Last revision (mm/dd/yy): 02/20/2009

Vulnerabilities Table of Contents


On some operating systems, the fact that the temp file exists may be apparent to any user.


Confidentiality: Since the file is visible and the application which is using the temp file could be known, the attacker has gained information about what the user is doing at that time.

Exposure period

  • Requirements specification: The choice could be made to use a language or library that is not susceptible to these issues.
  • Implementation: If one must use his own temp file implementation, many logic errors can lead to this condition.


  • Languages: All languages which support file input and output.
  • Operating platforms: This problem exists mainly on older operating systems and cygwin.

Required resources




Likelihood of exploit


Since the file is visible, the application which is using the temp file could be known. If one has access to list the processes on the system, the attacker has gained information about what the user is doing at that time. By correlating this with the applications the user is running, an attacker could potentially discover what a user's actions are. From this, higher levels of security could be breached.

Risk Factors



In C\C++:

FILE *stream;
char tempstring[] = "String to be written";

if( (stream = tmpfile()) == NULL ) {
   perror("Could not open new temporary file\n"); 
   return (-1);
/* write data to tmp file */
/* ... */

In cygwin and some older unixes one can ls /tmp and see that this temp file exists.

In Java:

try { 
    File temp = File.createTempFile("pattern", ".suffix");
    BufferedWriter out = new BufferedWriter(new FileWriter(temp));
    out.close(); } 
catch (IOException e) { } 

This temp file is readable by all users.

Related Attacks

Related Vulnerabilities

Related Controls

  • Requirements specification: Many contemporary languages have functions which properly handle this condition. Older C temp file functions are especially susceptible.
  • Implementation: Try to store sensitive tempfiles in a directory which is not world readable - i.e., per user temp files.
  • Implementation: Avoid using vulnerable temp file functions.

Related Technical Impacts