Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 66371 - dev-db/postgresql: Insecure tempfile handling
Summary: dev-db/postgresql: Insecure tempfile handling
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All All
: High minor (vote)
Assignee: Gentoo Security
URL: http://www.securityfocus.com/advisori...
Whiteboard: B3 [glsa] lewk
Keywords:
: 68865 (view as bug list)
Depends on:
Blocks:
 
Reported: 2004-10-04 17:09 UTC by Luke Macken (RETIRED)
Modified: 2011-10-30 22:37 UTC (History)
3 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments
postgresql-7.4.5-tempfile.patch (postgresql-7.4.5-tempfile.patch,1.42 KB, patch)
2004-10-04 17:10 UTC, Luke Macken (RETIRED)
no flags Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Luke Macken (RETIRED) gentoo-dev 2004-10-04 17:09:16 UTC
Problem description:

  Trustix Security Engineers identified that all these packages had one or
  more script(s) that handled temporary files in an insecure manner.  While
  it is not believed that any of these holes could lead to privilege
  escalation, it would be possible to trick the scripts to overwrite data
  writable by the user that invokes the script.

  These problems can only be exploited by local users, and they would have to
  wait for someone else, preferably root, to run the vulnerable scripts.
Comment 1 Luke Macken (RETIRED) gentoo-dev 2004-10-04 17:10:03 UTC
Created attachment 41113 [details, diff]
postgresql-7.4.5-tempfile.patch

Trustix patch to fix insecure tempfile handling.
Comment 2 Luke Macken (RETIRED) gentoo-dev 2004-10-04 17:12:37 UTC
postgresql herd,

please verify and apply patch.  thanks!
Comment 3 MATSUU Takuto (RETIRED) gentoo-dev 2004-10-08 07:57:09 UTC
in cvs (7.4.5-r2).
Comment 4 Luke Macken (RETIRED) gentoo-dev 2004-10-08 08:07:50 UTC
Thanks for the bump Matsuu.

Archs, please mark 7.4.5-r2 stable.
Comment 5 Pieter Van den Abeele (RETIRED) gentoo-dev 2004-10-08 08:29:48 UTC
done on ppc
Comment 6 Gustavo Zacarias (RETIRED) gentoo-dev 2004-10-08 12:57:03 UTC
stable on sparc.
Comment 7 Rumen Yotov 2004-10-09 02:38:35 UTC
Hi,
Today couldn't compile the new postgresql-7.4.5-r2. Have 7.4.5-r1 working.
In the emerge log there are messages suggesting the ebuild wants to use libgettextlib-0.14.1.so (from gettext-0.14.1) - nothing bad but a day or two ago downgraded gettext-0.14.1 down to ver.0.12.1-r2 (also due to security reasons - by memory).
Here's my error log:
...BEGIN...
configure: creating ./config.status
config.status: creating GNUmakefile
config.status: creating src/Makefile.global
config.status: creating src/include/pg_config.h
config.status: linking ./src/backend/port/tas/dummy.s to src/backend/port/tas.s
config.status: linking ./src/backend/port/dynloader/linux.c to src/backend/port/dynloader.c
config.status: linking ./src/backend/port/sysv_sema.c to src/backend/port/pg_sema.c
config.status: linking ./src/backend/port/sysv_shmem.c to src/backend/port/pg_shmem.c
config.status: linking ./src/backend/port/dynloader/linux.h to src/include/dynloader.h
config.status: linking ./src/include/port/linux.h to src/include/pg_config_os.h
config.status: linking ./src/makefiles/Makefile.linux to src/Makefile.port
make -C doc all
make[1]: Entering directory `/var/tmp/portage/postgresql-7.4.5-r2/work/postgresql-7.4.5/doc'
gzip -d -c man.tar.gz | /bin/tar xf -
for file in man1/*.1; do \
  mv $file $file.bak && \
  sed -e 's/\\fR(l)/\\fR(7)/' $file.bak >$file && \
  rm -f $file.bak || exit; \
done
/bin/sh ../config/mkinstalldirs man7
mkdir man7
for file in manl/*.l; do \
  sed -e '/^\.TH/s/"l"/"7"/'   \
              -e 's/\\fR(l)/\\fR(7)/' \
      $file >man7/`basename $file | sed 's/.l$/.7/'` || exit; \
done
make[1]: Leaving directory `/var/tmp/portage/postgresql-7.4.5-r2/work/postgresql-7.4.5/doc'
make -C src all
make[1]: Entering directory `/var/tmp/portage/postgresql-7.4.5-r2/work/postgresql-7.4.5/src'
make -C port all
make[2]: Entering directory `/var/tmp/portage/postgresql-7.4.5-r2/work/postgresql-7.4.5/src/port'
gcc -march=i686 -O2 -pipe -fomit-frame-pointer -fno-strict-aliasing -Wall -Wmissing-prototypes -Wmissing-declarations -I../../src/include -D_GNU_SOURCE   -c -o path.o path.c -MMD
gcc -march=i686 -O2 -pipe -fomit-frame-pointer -fno-strict-aliasing -Wall -Wmissing-prototypes -Wmissing-declarations -I../../src/include -D_GNU_SOURCE   -c -o sprompt.o sprompt.c -MMD
gcc -march=i686 -O2 -pipe -fomit-frame-pointer -fno-strict-aliasing -Wall -Wmissing-prototypes -Wmissing-declarations -I../../src/include -D_GNU_SOURCE   -c thread.c
ar crs libpgport.a path.o sprompt.o thread.o
make[2]: Leaving directory `/var/tmp/portage/postgresql-7.4.5-r2/work/postgresql-7.4.5/src/port'
make -C backend all
make[2]: Entering directory `/var/tmp/portage/postgresql-7.4.5-r2/work/postgresql-7.4.5/src/backend'
msgfmt -o po/cs.mo po/cs.po
msgfmt: error while loading shared libraries: libgettextlib-0.14.1.so: cannot open shared object file: No such file or directory
make[2]: *** [po/cs.mo] Error 127
make[2]: Leaving directory `/var/tmp/portage/postgresql-7.4.5-r2/work/postgresql-7.4.5/src/backend'
make[1]: *** [all] Error 2
make[1]: Leaving directory `/var/tmp/portage/postgresql-7.4.5-r2/work/postgresql-7.4.5/src'
make: *** [all] Error 2

!!! ERROR: dev-db/postgresql-7.4.5-r2 failed.
!!! Function src_compile, Line 131, Exitcode 2
!!! (no error message)
!!! If you need support, post the topmost build error, NOT this status message.
...END...
Thanks
Rumen
Comment 8 Bryan Østergaard (RETIRED) gentoo-dev 2004-10-09 08:08:28 UTC
Stable on alpha.

Rumen, your problem is unrelated to postgresql. Emerge sync and emerge gettext twice to fix it. See bug 66449 for more information.
Comment 9 Tom Gall (RETIRED) gentoo-dev 2004-10-09 20:17:20 UTC
stable on ppc64, thanks!
Comment 10 Masatomo Nakano (RETIRED) gentoo-dev 2004-10-11 10:29:42 UTC
Matsuu, Thank you.

But I think we should also fix 7.3.7.
It's also stable version and in different SLOT.

Can you fix it too?
Comment 11 Masatomo Nakano (RETIRED) gentoo-dev 2004-10-12 04:16:07 UTC
All ebuilds of postgresql are in same SLOT for now.
It's my misunderstanding.

Anyway, we should fix 7.3.7 as well.
Comment 12 Thierry Carrez (RETIRED) gentoo-dev 2004-10-12 04:39:29 UTC
The GLSA will ask people to upgrade to the latest version, so a fix for previous version is not necessary, strictly security-speaking.

Still waiting for x86 and amd64 to mark postgresql-7.4.5-r2 stable to issue GLSA.
Comment 13 Masatomo Nakano (RETIRED) gentoo-dev 2004-10-12 05:15:43 UTC
yes. but we can't delete 7.3.7 beacuse data format of 7.3.* and 7.4.* are not compatibility. Many people will continue using 7.3.*

So, I think we need to fix it too.
Comment 14 Thierry Carrez (RETIRED) gentoo-dev 2004-10-13 02:45:22 UTC
They should even be on different SLOTs :)

Yes, fix it in the other version too, we'll handle it on the GLSA one way or another.
Comment 15 Masatomo Nakano (RETIRED) gentoo-dev 2004-10-13 04:09:24 UTC
yes. I want to put them in different SLOT.
But there are some problems.. I'm going to do it when I have a time.

Anyway, I've also fixed 7.3.* as 7.3.7-r2.ebuild.
Archs, please mark 7.3.7-r2 stable as well.
Comment 16 Jochen Maes (RETIRED) gentoo-dev 2004-10-13 05:42:53 UTC
stable on ppc (both versions)
Comment 17 Guy Martin (RETIRED) gentoo-dev 2004-10-13 14:50:06 UTC
Done on hppa.
Comment 18 Bryan Østergaard (RETIRED) gentoo-dev 2004-10-13 19:04:41 UTC
Alpha stable.
Comment 19 Jason Wever (RETIRED) gentoo-dev 2004-10-14 20:53:22 UTC
7.3.7-r2 now stable on sparc
Comment 20 Danny van Dyk (RETIRED) gentoo-dev 2004-10-16 07:21:45 UTC
7.3.7-r2 and 7.4.5-r2 stable on amd64.
Comment 21 Akinori Hattori gentoo-dev 2004-10-17 05:16:15 UTC
7.3.7-r2 and 7.4.5-r2 stable on ia64.
Comment 22 Thierry Carrez (RETIRED) gentoo-dev 2004-10-18 13:38:42 UTC
GLSA 200410-16
mips, s390, arm : please mark stable to benefit from GLSA
Comment 23 Rajiv Aaron Manglani (RETIRED) gentoo-dev 2004-10-25 11:04:02 UTC
*** Bug 68865 has been marked as a duplicate of this bug. ***
Comment 24 Hardave Riar (RETIRED) gentoo-dev 2005-02-19 15:01:23 UTC
Later versions marked stable on mips.