Hexxeh/rpi-update — pull request #67 by technion (2013-02-07 00:54:15+00:00)
Title: Insecure tmp file handling

A malicious user can clobber any file due to insecure tmp file handling. Example:

pi@raspberrypi ~ $ ln -s /etc/passwd /tmp/updateScript.sh
pi@raspberrypi ~ $ sudo rpi-update
...
pi@raspberrypi ~ $ cat /etc/passwd
#!/bin/bash
if mv "./testfile.sh.tmp" "./testfile.sh"; then
rm -- "$0"
exec env UPDATE_SELF=0 /bin/bash "./testfile.sh" ""
else
echo " !!! Failed!"
fi

As of this point, the pi is quite unusable.

As there are already references in the code to data stored in the root user's home directory, I have replicated that configuration in this patch.