kx5x5by nameby nameBUILDd kHA./AA kM/ mx5x5x5$ ./lpp_namemm4 R S bos.txt { bos.txt.spell 4.3.1.1 01 N U En_US Writer's Tools Commands [ % /usr/bin 16 /usr/lpp/SAVESPACE 16 /usr/lib/objrepos 8 INSTWORK 56 16 % % % IX79701 2 SECURITY: insecure temporary files in cmdtext scripts % ] } k\A./usrAA k{A./usr/lppAA kA./usr/lpp/bos.txt/bos.txt.spell/4.3.1.1AA kFl& mhx5x5x5$ ~h./usr/lpp/bos.txt/bos.txt.spell/4.3.1.1/liblpp.amm 1862 0 68 1506 0 19 190 0 875243949 300 300 644 9 productid` bos.txt 5765-C3403 360 664 68 899511788 300 300 640 23 bos.txt.spell.copyright` Licensed Materials - Property of IBM 5765C3403 (C) Copyright International Business Machines Corp. 1989, 1998. (C) Copyright AT&T 1984. (C) Copyright Regents of the University of California 1980. All rights reserved. US Government Users Restricted Rights - Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp. 424 1202 190 899512566 300 300 640 23 bos.txt.spell.inventory` /usr/bin/diction: owner = bin group = bin mode = 755 type = FILE class = apply,inventory,bos.txt.spell size = 1728 checksum = "57572 2 " /usr/bin/spellin: owner = bin group = bin mode = 755 type = FILE class = apply,inventory,bos.txt.spell size = 2091 checksum = "35569 3 " 54 1364 664 899512566 300 300 640 18 bos.txt.spell.size` /usr/bin 16 /usr/lpp/SAVESPACE 16 /usr/lib/objrepos 8 36 1506 1202 899512566 300 300 640 16 bos.txt.spell.al` ./usr/bin/diction ./usr/bin/spellin 244 1862 1364 899512566 300 300 640 21 bos.txt.spell.fixdata` fix: name = IX79701 abstract = insecure temporary files in cmdtext scripts type = f filesets = "bos.txt.spell:4.3.1.1\n\ bos.txt.tfs:4.3.1.2\n\ " symptom = " Temporary files are created under world readable/writable\n\ directories.\n\ " 200 0 1506 0 0 0 0 0 ` 6 68 190 664 1202 1364 1506 productidbos.txt.spell.copyrightbos.txt.spell.inventorybos.txt.spell.sizebos.txt.spell.albos.txt.spell.fixdata kSx5t5u5$./usr/bin/diction#!/bin/sh # IBM_PROLOG_BEGIN_TAG # This is an automatically generated prolog. # # cmdtext43D src/cmdtext/usr/bin/diction/diction.sh 1.9 # # Licensed Materials - Property of IBM # # (C) COPYRIGHT International Business Machines Corp. 1993,1998 # All Rights Reserved # # US Government Users Restricted Rights - Use, duplication or # disclosure restricted by GSA ADP Schedule Contract with IBM Corp. # # IBM_PROLOG_END_TAG # @(#)92 1.9 src/cmdtext/usr/bin/diction/diction.sh, cmdtext, cmdtext43D, d9827D1 6/16/98 10:34:16 # # COMPONENT_NAME: (CMDTEXT) Text Formatting Services # # FUNCTIONS: # # ORIGINS: 3, 27 # # (C) COPYRIGHT International Business Machines Corp. 1998 # All Rights Reserved # Licensed Materials - Property of IBM # #D=/usr/bin #B=/usr/lib echo "$*" umask 077 TMPDIR=${TMPDIR:-$HOME/tmp} [[ ! -d $TMPDIR ]] && TMPDIR=/tmp TMPDIR=$TMPDIR/${0##*/}.$$ tmp=$TMPDIR/diction.$RANDOM mkdir $TMPDIR || { print -u2 "${0##*/}: Could not create temporary files" exit 1 } trap "/bin/rm -rf $TMPDIR 2>/dev/null" EXIT INT TERM QUIT HUP rest= flag= nflag= mflag=-me lflag=-ml kflag= file= set -- `getopt f:nkm: $* 2>/dev/null` if [ $? != 0 ] ; then dspmsg dprog.cat 1 "Invalid flags\n" exit 2 fi while [ $1 != -- ]; do case $1 in -f) flag=-f;shift; file=$1; shift; continue;; -n) nflag=-n;shift; continue;; -k) kflag=-k;shift; continue;; -m) case $2 in m|s|e|a) mflag=$1$2;; # Added mflag below to force deroff to ignore MM macros. l) lflag=-ml; mflag=-mm;; esac; shift; shift; continue;; esac done shift rest=$* #$D/deroff $kflag $lflag $mflag $rest^$B/dprog -d $nflag $flag $file deroff $kflag $lflag $mflag $rest > $tmp cat $tmp |dprog -d $nflag $flag $file rm -rf $TMPDIR k+x5t5 u5$s+./usr/bin/spellin#!/bin/ksh # IBM_PROLOG_BEGIN_TAG # This is an automatically generated prolog. # # cmdtext43D src/cmdtext/usr/bin/spell/spellin.sh 1.7 # # Licensed Materials - Property of IBM # # (C) COPYRIGHT International Business Machines Corp. 1989,1991 # All Rights Reserved # # US Government Users Restricted Rights - Use, duplication or # disclosure restricted by GSA ADP Schedule Contract with IBM Corp. # # IBM_PROLOG_END_TAG # @(#)62 1.7 src/cmdtext/usr/bin/spell/spellin.sh, cmdtext, cmdtext43D, d9827D1 6/16/98 10:40:30 # # COMPONENT_NAME: (CMDTEXT) Text Formatting Services # # FUNCTIONS: # # ORIGINS: 3,10,13,27 # # (C) COPYRIGHT International Business Machines Corp. 1989, 1998 # All Rights Reserved # Licensed Materials - Property of IBM # # US Government Users Restricted Rights - Use, duplication or # disclosure restricted by GSA ADP Schedule Contract with IBM Corp. # # # spellin.sh - front end to /usr/lib/spell/spellinprg # # This front end script provides for the overlapping functionality # of the BSD and ATT versions (which are completely different). PATH=/bin:/usr/bin export PATH SPELL=/usr/lib/spell umask 077 TMPDIR=${TMPDIR:-$HOME/tmp} [[ ! -d $TMPDIR ]] && TMPDIR=/tmp TMPDIR=$TMPDIR/${0##*/}.$$ mkdir $TMPDIR || { print -u2 "${0##*/}: Could not create temporary files" exit 1 } TMP=spellin TMPA=$TMPDIR/${TMP}A.$$ TMPB=$TMPDIR/${TMP}B.$$ TMPC=$TMPDIR/${TMP}C.$$ status=0 trap 'rm -rf $TMPDIR >/dev/null 2>&1; exit $status' 0 trap 'status=1;exit' 1 2 3 15 case A$1 in A[0-9]*) # spellin num < in > out $SPELL/spellinprg $1 ;; A) # spellin < in > out $SPELL/hashmake | sort -u +0n > $TMPC $SPELL/spellinprg `wc -l < $TMPC` < $TMPC ;; A[!0-9]*) # spellin list < in > out if [ -s $1 ] then $SPELL/hashcheck < $1 > $TMPA & $SPELL/hashmake | sort -u +0n > $TMPB wait sort -mu $TMPA $TMPB > $TMPC $SPELL/spellinprg `wc -l < $TMPC` < $TMPC else dspmsg spell.cat 8 "spellin: List file %s does not exist.\n" $1 >&2 fi ;; esac status=$? # trap 0 handles the exit code k  PATH=/bin:/usr/bin export PATH SPELL=/usr/lib/spell umask 077 TMPDIR=${TMPDIR:-$HOME/tmp} [[ ! -d $TMPDIR ]] && TMPDIR=/tmp TMPDIR=$TMPDIR/${0##*/}.$$ mkdir $TMPDIR || { print -u2 "${0##*/}: Could not create temporary files" exit 1 } TMP=spellin TMPA=$TMPDIR/${TMP}A.$$ TMPB=$TMPDIR/${TMP}B.$$ TMPC=$TMPDIR/${TMP}C.$$ status=0 trap 'rm -rf $TMPDIR >/dev/null 2>&1; exit $status' 0 trap 'status=1;exit' 1 2 3 15 case A$1 in A[0-9]*) # spellin num < in > out $SPELL/spellinprg $1 ;; A) # spellin < in > out $SPELL/hashmake | sort -u +0n > $TMPC $SPELL/spellinprg `wc -l < $TMPC` < $TMPC ;; A[!0-9]*) # spellin list < in > out if [ -s $1 ] then $SPELL/hashcheck < $1 > $TMPA & $SPELL/hashmake | sort -u +0n > $TMPB wait sort -mu $TMPA $TMPB > $TMPC $SPELL/spellinprg `wc -l < $TMPC` < $TMPC else d