Bug 66357 - app-text/ghostscript: Insecure tempfile handling
Bug#: 66357 Product:  Gentoo Linux Version: unspecified Platform: All
OS/Version: All Status: RESOLVED Severity: normal Priority: P2
Resolution: FIXED Assigned To: security@gentoo.org Reported By: lewk@gentoo.org
Component: Security
URL:  http://www.securityfocus.com/advisories/7263
Summary: app-text/ghostscript: Insecure tempfile handling
Keywords:  
Status Whiteboard: A3 [glsa] lewk
Opened: 2004-10-04 15:08 0000
Description:   Opened: 2004-10-04 15:08 0000 
Problem description:

  Trustix Security Engineers identified that all these packages had one or
  more script(s) that handled temporary files in an insecure manner.  While
  it is not believed that any of these holes could lead to privilege
  escalation, it would be possible to trick the scripts to overwrite data
  writable by the user that invokes the script.

  These problems can only be exploited by local users, and they would have to
  wait for someone else, preferably root, to run the vulnerable scripts.

------- Comment #1 From Luke Macken (RETIRED) 2004-10-04 15:09:36 0000 ------- 
Created an attachment (id=41096) [details]
ghostscript-7.07.1-tempfile.patch

Trustix patch to fix insecure tempfile handling.

------- Comment #2 From Luke Macken (RETIRED) 2004-10-04 15:10:11 0000 ------- 
printing herd,

please verify and apply patch if necessary.

------- Comment #3 From Heinrich Wendel (RETIRED) 2004-10-07 08:10:10 0000 ------- 
added ghostscript-7.07.1-r7 to portage, but there is still ghostscript-7.05.6
which is required for ppc, see bug #49227, it may be vulnerable as well, but
the patch does not apply there

------- Comment #4 From Luke Macken (RETIRED) 2004-10-07 08:18:09 0000 ------- 
archs, please mark ghostscript-7.07.1-r7 stable.

------- Comment #5 From Gustavo Zacarias (RETIRED) 2004-10-07 10:19:50 0000 ------- 
sparc tasty.

------- Comment #6 From Jeremy Huddleston (RETIRED) 2004-10-07 14:54:31 0000 ------- 
stable amd64

------- Comment #7 From Bryan Østergaard (RETIRED) 2004-10-07 15:44:11 0000 ------- 
Stable on alpha.

------- Comment #8 From Guy Martin 2004-10-07 16:47:50 0000 ------- 
hppa happy

------- Comment #9 From Olivier Crete 2004-10-07 17:33:03 0000 ------- 
x86 is there

------- Comment #10 From SpanKY 2004-10-07 18:47:45 0000 ------- 
ia64 stable

------- Comment #11 From Thierry Carrez (RETIRED) 2004-10-08 00:57:06 0000 ------- 
We'll need a patch that would apply to a ppc-compatible version of ghostscript
(7.05.06) to fix it for ppc as well. Back to ebuild status to solve the ppc
case.

------- Comment #12 From Luke Macken (RETIRED) 2004-10-08 20:18:17 0000 ------- 
Created an attachment (id=41402) [details]
gs7.05.6-tempfile.patch

Patch to fix tempfile vulnerabilities in 7.05.6 (ppc)

------- Comment #13 From Tom Gall 2004-10-09 19:59:34 0000 ------- 
stable on ppc64, thanks!

(The comments about ppc leave me somewhat stunned...  if the 7.07.1-r7 version works just fine with ppc64, so should ppc, least so I owuld think unless there is some bug I just haven't hit yet waiting out there in the weeds for some poor unsuspecting ppc64 user)

------- Comment #14 From Luke Macken (RETIRED) 2004-10-09 22:43:08 0000 ------- 
printing herd,

please apply tempfile patch to 7.05.6 for ppc.

------- Comment #15 From Hardave Riar (RETIRED) 2004-10-16 21:45:40 0000 ------- 
Stable on mips

------- Comment #16 From Luke Macken (RETIRED) 2004-10-17 20:52:05 0000 ------- 
Ready to draft GLSA.

------- Comment #17 From Thierry Carrez (RETIRED) 2004-10-18 06:16:19 0000 ------- 
This can't be at GLSA status : still waiting for printing herd to apply
tempfile patch to a ppc-supported version... like 7.05.6-r2.

------- Comment #18 From Heinrich Wendel (RETIRED) 2004-10-18 11:20:08 0000 ------- 
added gs-7.05.6-r2 for ppc

------- Comment #19 From Luke Macken (RETIRED) 2004-10-18 11:53:22 0000 ------- 
ppc, please mark ghostscript-7.05.6-r2 stable.

------- Comment #20 From Jochen Maes (RETIRED) 2004-10-19 02:29:44 0000 ------- 
stable on ppc

------- Comment #21 From Thierry Carrez (RETIRED) 2004-10-19 05:15:34 0000 ------- 
Now we're set...

------- Comment #22 From Thierry Carrez (RETIRED) 2004-10-20 14:22:14 0000 ------- 
GLSA 200410-18