66357 2004-10-04 15:08 0000 app-text/ghostscript: Insecure tempfile handling 2004-10-20 14:22:14 0000 1 1 1 Unclassified Gentoo Linux Security unspecified All All RESOLVED FIXED http://www.securityfocus.com/advisories/7263 A3 [glsa] lewk P2 normal --- 1 lewk@gentoo.org security@gentoo.org printing@gentoo.org lewk@gentoo.org 2004-10-04 15:08:48 0000 Problem description: Trustix Security Engineers identified that all these packages had one or more script(s) that handled temporary files in an insecure manner. While it is not believed that any of these holes could lead to privilege escalation, it would be possible to trick the scripts to overwrite data writable by the user that invokes the script. These problems can only be exploited by local users, and they would have to wait for someone else, preferably root, to run the vulnerable scripts. lewk@gentoo.org 2004-10-04 15:09:36 0000 Created an attachment (id=41096) ghostscript-7.07.1-tempfile.patch Trustix patch to fix insecure tempfile handling. lewk@gentoo.org 2004-10-04 15:10:11 0000 printing herd, please verify and apply patch if necessary. lanius@gentoo.org 2004-10-07 08:10:10 0000 added ghostscript-7.07.1-r7 to portage, but there is still ghostscript-7.05.6 which is required for ppc, see bug #49227, it may be vulnerable as well, but the patch does not apply there lewk@gentoo.org 2004-10-07 08:18:09 0000 archs, please mark ghostscript-7.07.1-r7 stable. gustavoz@gentoo.org 2004-10-07 10:19:50 0000 sparc tasty. eradicator@gentoo.org 2004-10-07 14:54:31 0000 stable amd64 kloeri@gentoo.org 2004-10-07 15:44:11 0000 Stable on alpha. gmsoft@gentoo.org 2004-10-07 16:47:50 0000 hppa happy tester@gentoo.org 2004-10-07 17:33:03 0000 x86 is there vapier@gentoo.org 2004-10-07 18:47:45 0000 ia64 stable koon@gentoo.org 2004-10-08 00:57:06 0000 We'll need a patch that would apply to a ppc-compatible version of ghostscript (7.05.06) to fix it for ppc as well. Back to ebuild status to solve the ppc case. lewk@gentoo.org 2004-10-08 20:18:17 0000 Created an attachment (id=41402) gs7.05.6-tempfile.patch Patch to fix tempfile vulnerabilities in 7.05.6 (ppc) tgall@gentoo.org 2004-10-09 19:59:34 0000 stable on ppc64, thanks! (The comments about ppc leave me somewhat stunned... if the 7.07.1-r7 version works just fine with ppc64, so should ppc, least so I owuld think unless there is some bug I just haven't hit yet waiting out there in the weeds for some poor unsuspecting ppc64 user) lewk@gentoo.org 2004-10-09 22:43:08 0000 printing herd, please apply tempfile patch to 7.05.6 for ppc. hardave@gentoo.org 2004-10-16 21:45:40 0000 Stable on mips lewk@gentoo.org 2004-10-17 20:52:05 0000 Ready to draft GLSA. koon@gentoo.org 2004-10-18 06:16:19 0000 This can't be at GLSA status : still waiting for printing herd to apply tempfile patch to a ppc-supported version... like 7.05.6-r2. lanius@gentoo.org 2004-10-18 11:20:08 0000 added gs-7.05.6-r2 for ppc lewk@gentoo.org 2004-10-18 11:53:22 0000 ppc, please mark ghostscript-7.05.6-r2 stable. sejo@gentoo.org 2004-10-19 02:29:44 0000 stable on ppc koon@gentoo.org 2004-10-19 05:15:34 0000 Now we're set... koon@gentoo.org 2004-10-20 14:22:14 0000 GLSA 200410-18 41096 2004-10-04 15:09 0000 ghostscript-7.07.1-tempfile.patch ghostscript-7.07.1-tempfile.patch text/plain ZGlmZiAtdXIgZXNwZ3MtNy4wNy4xLm9yaWcvbGliL3BqLWdzLnNoIGVzcGdzLTcuMDcuMS9saWIv cGotZ3Muc2gKLS0tIGVzcGdzLTcuMDcuMS5vcmlnL2xpYi9wai1ncy5zaAkyMDAyLTA0LTIzIDEz OjU4OjM2LjAwMDAwMDAwMCArMDIwMAorKysgZXNwZ3MtNy4wNy4xL2xpYi9wai1ncy5zaAkyMDA0 LTA5LTEzIDEwOjA0OjAwLjAwMDAwMDAwMCArMDIwMApAQCAtMjQxLDYgKzI0MSw3IEBACiAJCQl0 aGVuCiAJCQkJL3Vzci9saWIvbHByY2F0ICROb2ZpbHRlciAkTm9sYWJlbCAkZmlsZSBQQ0wxICR1 c2VyICRkZXYKIAkJCWVsc2UKKwkJCQlURU1QRklMRT1gbWt0ZW1wIC10IHBqWFhYWFhYYCB8fCBl eGl0IDEKIAkJCQl0eXBlPWBmaWxlICRmaWxlIHwgc2VkICdzL15bXjpdKi4uLy8nYAogCQkJCWNh c2UgIiR0eXBlIiBpbgogCQkJCXBvc3RzY3JpcHQqKQpAQCAtMjUxLDIyICsyNTIsMjIgQEAKICMK ICMJCQkJCWdzIC1xIC1zREVWSUNFPXBhaW50amV0IC1yMTgwIC1zT3V0cHV0RmlsZT0tIC1kRElT S0ZPTlRTIC1kTk9QQVVTRSAtIDwgJGZpbGUgMj4vdG1wL3NoJCQKIAotCQkJCQlncyAtcSAtc0RF VklDRT1wYWludGpldCAtcjE4MCAtc091dHB1dEZpbGU9L3RtcC9waiQkIC1kRElTS0ZPTlRTIC1k Tk9QQVVTRSAtIDwgJGZpbGUgMT4yCi0JCQkJCWNhdCAvdG1wL3BqJCQKLQkJCQkJcm0gL3RtcC9w aiQkCisJCQkJCWdzIC1xIC1zREVWSUNFPXBhaW50amV0IC1yMTgwIC1zT3V0cHV0RmlsZT0kVEVN UEZJTEUgLWRESVNLRk9OVFMgLWROT1BBVVNFIC0gPCAkZmlsZSAxPjIKKwkJCQkJY2F0ICRURU1Q RklMRQorCQkJCQlybSAkVEVNUEZJTEUKIAkJCQkJbmVlZGZmPQogCQkJCQk7OwotCQkJCSopCWNh dCAiJGZpbGUiIDI+L3RtcC9zaCQkCisJCQkJKikJY2F0ICIkZmlsZSIgMj4kVEVNUEZJTEUKIAkJ CQkJbmVlZGZmPTEKIAkJCQkJOzsKIAkJCQllc2FjCiAKLQkJCQlpZiBbIC1zIC90bXAvc2gkJCBd CisJCQkJaWYgWyAtcyAkVEVNUEZJTEUgXQogCQkJCXRoZW4KICMJCQkJICAgIGNhdCAvdG1wL3No JCQJIyBvdXRwdXQgYW55IGVycm9ycwotCQkJCSAgICBjYXQgL3RtcC9zaCQkIDE+MgkjIG91dHB1 dCBhbnkgZXJyb3JzCisJCQkJICAgIGNhdCAkVEVNUEZJTEUgMT4yCSMgb3V0cHV0IGFueSBlcnJv cnMKIAkJCQlmaQotCQkJCXJtIC1mIC90bXAvc2gkJAorCQkJCXJtIC1mICRURU1QRklMRQogCQkJ CWlmIFsgJG5lZWRmZiBdOyB0aGVuIGVjaG8gIlwwMTRcclxjIjsgZmkKIAkJCWZpCiAKZGlmZiAt dXIgZXNwZ3MtNy4wNy4xLm9yaWcvbGliL3BzMmVwc2kgZXNwZ3MtNy4wNy4xL2xpYi9wczJlcHNp Ci0tLSBlc3Bncy03LjA3LjEub3JpZy9saWIvcHMyZXBzaQkyMDAzLTA5LTAyIDIwOjAxOjMxLjAw MDAwMDAwMCArMDIwMAorKysgZXNwZ3MtNy4wNy4xL2xpYi9wczJlcHNpCTIwMDQtMDktMTMgMTA6 MDU6MzEuMDAwMDAwMDAwICswMjAwCkBAIC0xLDEyICsxLDcgQEAKICMhL2Jpbi9zaAogIyAkSWQ6 IHBzMmVwc2ksdiAxLjcgMjAwMy8wOS8wMiAxODowMTozMSBlYXN5c3cgRXhwICQKIAotdG1wZmls ZT0vdG1wL3BzMmVwc2kkJAotcm0gLWYgJHRtcGZpbGUKLWlmIHRlc3QgLWUgJHRtcGZpbGU7IHRo ZW4KLQllY2hvICIkMDogT3VyIHRlbXBvcmFyeSBmaWxlICR0bXBmaWxlIGFscmVhZHkgZXhpc3Rz LiIgMT4mMgotCWV4aXQgMQotZmkKK3RtcGZpbGU9YG1rdGVtcCAtdCBwczJlcHNpWFhYWFhYYCB8 fCBleGl0IDEKIHRyYXAgInJtIC1yZiAkdG1wZmlsZSIgMCAxIDIgMyA3IDEzIDE1CiAKIGV4cG9y dCBvdXRmaWxlCmRpZmYgLXVyIGVzcGdzLTcuMDcuMS5vcmlnL2xpYi9wdi5zaCBlc3Bncy03LjA3 LjEvbGliL3B2LnNoCi0tLSBlc3Bncy03LjA3LjEub3JpZy9saWIvcHYuc2gJMjAwMi0wNC0yMyAx Mzo1ODozNi4wMDAwMDAwMDAgKzAyMDAKKysrIGVzcGdzLTcuMDcuMS9saWIvcHYuc2gJMjAwNC0w OS0xMyAxMDowODowMS4wMDAwMDAwMDAgKzAyMDAKQEAgLTI5LDkgKzI5LDEwIEBACiBQQUdFPSQx CiBzaGlmdAogRklMRT0kMQorVEVNUEZJTEU9YG1rdGVtcCAtdCAke0ZJTEV9WFhYWFhYYCB8fCBl eGl0IDEKIHNoaWZ0Ci10cmFwICJybSAtcmYgJFRFTVBESVIvJEZJTEUuJCQucHYiIDAgMSAyIDE1 Cit0cmFwICJybSAtcmYgJFRFTVBGSUxFIiAwIDEgMiAxNQogI2R2aXBzIC1EJFJFU09MVVRJT04g LXAgJFBBR0UgLW4gMSAkRklMRSAkKiAtbyAkRklMRS4kJC5wdgotZHZpcHMgLXAgJFBBR0UgLW4g MSAkRklMRSAkKiAtbyAkRklMRS4kJC5wdgotZ3MgJEZJTEUuJCQucHYKK2R2aXBzIC1wICRQQUdF IC1uIDEgJEZJTEUgJCogLW8gJFRFTVBGSUxFCitncyAkVEVNUEZJTEUKIGV4aXQgMApkaWZmIC11 ciBlc3Bncy03LjA3LjEub3JpZy9saWIvc3lzdmxwLnNoIGVzcGdzLTcuMDcuMS9saWIvc3lzdmxw LnNoCi0tLSBlc3Bncy03LjA3LjEub3JpZy9saWIvc3lzdmxwLnNoCTIwMDItMDQtMjMgMTM6NTg6 MzcuMDAwMDAwMDAwICswMjAwCisrKyBlc3Bncy03LjA3LjEvbGliL3N5c3ZscC5zaAkyMDA0LTA5 LTEzIDEwOjE0OjQ2LjAwMDAwMDAwMCArMDIwMApAQCAtMjcsMjAgKzI3LDIzIEBACiAjIEJyb3Ro ZXIgSEwtNDogc3dpdGNoIHRvIEhQIGxhc2VyamV0IElJKyBlbXVsYXRpb24KICMgZWNobyAiXDAz M1wwMTVIXGMiCiAKK1RFTVBESVI9YG1rdGVtcCAtdGQgc3lzdmxwLlhYWFhYWGAgfHwgZXhpdCAx CisKIGk9MQogd2hpbGUgWyAkaSAtbGUgJGNvcGllcyBdCiBkbwogCWZvciBmaWxlIGluICRmaWxl cwogCWRvCiAJCSRHU0hPTUUvZ3MgXAotCQkJLXNPVVRQVVRGSUxFPS90bXAvcHNwJCQuJTAyZCBc CisJCQktc09VVFBVVEZJTEU9JFRFTVBESVIvcHNwJCQuJTAyZCBcCiAJCQktc0RFVklDRT0kREVW SUNFIFwKIAkJCSRFSEFORExFUiAkZmlsZSBcCiAJCQk8IC9kZXYvbnVsbCA+PiAvdXNyL3RtcC9w c19sb2cgMj4mMQogCi0JCWNhdCAvdG1wL3BzcCQkLiogMj4+IC91c3IvdG1wL3BzX2xvZwotCQly bSAtZiAvdG1wL3BzcCQkLioKKwkJY2F0ICRURU1QRElSL3BzcCQkLiogMj4+IC91c3IvdG1wL3Bz X2xvZworCQlybSAtZiAkVEVNUERJUi9wc3AkJC4qCiAJZG9uZQogCWk9YGV4cHIgJGkgKyAxYAog ZG9uZQorcm1kaXIgJFRFTVBESVIKIGV4aXQgMAo= 41402 2004-10-08 20:18 0000 gs7.05.6-tempfile.patch gs7.05.6-tempfile.patch text/plain LS0tIGVzcGdzLTcuMDUuNi9saWIvcGotZ3Muc2gub3JpZwkyMDA0LTEwLTA4IDE4OjQ4OjE1LjEy NTU4NjIwMCAtMDQwMAorKysgZXNwZ3MtNy4wNS42L2xpYi9wai1ncy5zaAkyMDA0LTEwLTA4IDE4 OjUxOjI5LjA4NjA5OTcyMCAtMDQwMApAQCAtMjQxLDYgKzI0MSw3IEBACiAJCQl0aGVuCiAJCQkJ L3Vzci9saWIvbHByY2F0ICROb2ZpbHRlciAkTm9sYWJlbCAkZmlsZSBQQ0wxICR1c2VyICRkZXYK IAkJCWVsc2UKKwkJCQlURU1QRklMRT1gbWt0ZW1wIC10IHBqWFhYWFhYYCB8fCBleGl0IDEKIAkJ CQl0eXBlPWBmaWxlICRmaWxlIHwgc2VkICdzL15bXjpdKi4uLy8nYAogCQkJCWNhc2UgIiR0eXBl IiBpbgogCQkJCXBvc3RzY3JpcHQqKQpAQCAtMjUxLDIyICsyNTIsMjIgQEAKICMKICMJCQkJCWdz IC1xIC1zREVWSUNFPXBhaW50amV0IC1yMTgwIC1zT3V0cHV0RmlsZT0tIC1kRElTS0ZPTlRTIC1k Tk9QQVVTRSAtIDwgJGZpbGUgMj4vdG1wL3NoJCQKIAotCQkJCQlncyAtcSAtc0RFVklDRT1wYWlu dGpldCAtcjE4MCAtc091dHB1dEZpbGU9L3RtcC9waiQkIC1kRElTS0ZPTlRTIC1kTk9QQVVTRSAt IDwgJGZpbGUgMT4yCi0JCQkJCWNhdCAvdG1wL3BqJCQKLQkJCQkJcm0gL3RtcC9waiQkCisJCQkJ CWdzIC1xIC1zREVWSUNFPXBhaW50amV0IC1yMTgwIC1zT3V0cHV0RmlsZT0kVEVNUEZJTEUgLWRE SVNLRk9OVFMgLWROT1BBVVNFIC0gPCAkZmlsZSAxPjIKKwkJCQkJY2F0ICRURU1QRklMRQorCQkJ CQlybSAkVEVNUEZJTEUKIAkJCQkJbmVlZGZmPQogCQkJCQk7OwotCQkJCSopCWNhdCAiJGZpbGUi IDI+L3RtcC9zaCQkCisJCQkJKikJY2F0ICIkZmlsZSIgMj4kVEVNUEZJTEUKIAkJCQkJbmVlZGZm PTEKIAkJCQkJOzsKIAkJCQllc2FjCiAKLQkJCQlpZiBbIC1zIC90bXAvc2gkJCBdCisJCQkJaWYg WyAtcyAkVEVNUEZJTEUgXQogCQkJCXRoZW4KICMJCQkJICAgIGNhdCAvdG1wL3NoJCQJIyBvdXRw dXQgYW55IGVycm9ycwotCQkJCSAgICBjYXQgL3RtcC9zaCQkIDE+MgkjIG91dHB1dCBhbnkgZXJy b3JzCisJCQkJICAgIGNhdCAkVEVNUEZJTEUgMT4yCSMgb3V0cHV0IGFueSBlcnJvcnMKIAkJCQlm aQotCQkJCXJtIC1mIC90bXAvc2gkJAorCQkJCXJtIC1mICRURU1QRklMRQogCQkJCWlmIFsgJG5l ZWRmZiBdOyB0aGVuIGVjaG8gIlwwMTRcclxjIjsgZmkKIAkJCWZpCiAKLS0tIGVzcGdzLTcuMDUu Ni9saWIvcHMyZXBzaS5vcmlnCTIwMDQtMTAtMDggMjI6MTY6MzcuMTk0OTgyNzYwIC0wNDAwCisr KyBlc3Bncy03LjA1LjYvbGliL3BzMmVwc2kJMjAwNC0xMC0wOCAyMzowMzoyNS4zMjAwODI4NTYg LTA0MDAKQEAgLTEsNyArMSw4IEBACiAjIS9iaW4vc2gKICMgJElkOiBwczJlcHNpLHYgMS40IDIw MDIvMDQvMjMgMTE6NTg6MzYgZWFzeXN3IEV4cCAkCiAKLXRtcGZpbGU9L3RtcC9wczJlcHNpJCQK K3RtcGZpbGU9YG1rdGVtcCAtdCBwczJlcHNpWFhYWFhYYCB8fCBleGl0IDEKK3RyYXAgInJtIC1y ZiAkdG1wZmlsZSIgMCAxIDIgMyA3IDEzIDE1CiAKIGV4cG9ydCBvdXRmaWxlCiAKLS0tIGVzcGdz LTcuMDUuNi9saWIvcHYuc2gub3JpZwkyMDA0LTEwLTA4IDE4OjUyOjEzLjIyNzM4OTIyNCAtMDQw MAorKysgZXNwZ3MtNy4wNS42L2xpYi9wdi5zaAkyMDA0LTEwLTA4IDE4OjUzOjA1LjQ1OTQ0ODc0 NCAtMDQwMApAQCAtMjcsMTEgKzI3LDEyIEBACiAjCiBURU1QRElSPS4KIFBBR0U9JDEKK1RFTVBG SUxFPWBta3RlbXAgLXQgJHtGSUxFfVhYWFhYWGAgfHwgZXhpdCAxCiBzaGlmdAogRklMRT0kMQog c2hpZnQKLXRyYXAgInJtIC1yZiAkVEVNUERJUi8kRklMRS4kJC5wdiIgMCAxIDIgMTUKK3RyYXAg InJtIC1yZiAkVEVNUEZJTEUiIDAgMSAyIDE1CiAjZHZpcHMgLUQkUkVTT0xVVElPTiAtcCAkUEFH RSAtbiAxICRGSUxFICQqIC1vICRGSUxFLiQkLnB2Ci1kdmlwcyAtcCAkUEFHRSAtbiAxICRGSUxF ICQqIC1vICRGSUxFLiQkLnB2Ci1ncyAkRklMRS4kJC5wdgorZHZpcHMgLXAgJFBBR0UgLW4gMSAk RklMRSAkKiAtbyAkVEVNUEZJTEUKK2dzICRURU1QRklMRQogZXhpdCAwCi0tLSBlc3Bncy03LjA1 LjYvbGliL3N5c3ZscC5zaC5vcmlnCTIwMDQtMTAtMDggMTg6NTM6MTAuNTIxNjc5MTY4IC0wNDAw CisrKyBlc3Bncy03LjA1LjYvbGliL3N5c3ZscC5zaAkyMDA0LTEwLTA4IDE4OjU0OjEwLjUxMjU1 OTE2OCAtMDQwMApAQCAtMjcsMjAgKzI3LDIzIEBACiAjIEJyb3RoZXIgSEwtNDogc3dpdGNoIHRv IEhQIGxhc2VyamV0IElJKyBlbXVsYXRpb24KICMgZWNobyAiXDAzM1wwMTVIXGMiCiAKK1RFTVBE SVI9YG1rdGVtcCAtdGQgc3lzdmxwLlhYWFhYWGAgfHwgZXhpdCAxCisKIGk9MQogd2hpbGUgWyAk aSAtbGUgJGNvcGllcyBdCiBkbwogCWZvciBmaWxlIGluICRmaWxlcwogCWRvCiAJCSRHU0hPTUUv Z3MgXAotCQkJLXNPVVRQVVRGSUxFPS90bXAvcHNwJCQuJTAyZCBcCisJCQktc09VVFBVVEZJTEU9 JFRFTVBESVIvcHNwJCQuJTAyZCBcCiAJCQktc0RFVklDRT0kREVWSUNFIFwKIAkJCSRFSEFORExF UiAkZmlsZSBcCiAJCQk8IC9kZXYvbnVsbCA+PiAvdXNyL3RtcC9wc19sb2cgMj4mMQogCi0JCWNh dCAvdG1wL3BzcCQkLiogMj4+IC91c3IvdG1wL3BzX2xvZwotCQlybSAtZiAvdG1wL3BzcCQkLioK KwkJY2F0ICRURU1QRElSL3BzcCQkLiogMj4+IC91c3IvdG1wL3BzX2xvZworCQlybSAtZiAkVEVN UERJUi9wc3AkJC4qCiAJZG9uZQogCWk9YGV4cHIgJGkgKyAxYAogZG9uZQorcm1kaXIgJFRFTVBE SVIKIGV4aXQgMAo=