Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 122141 - net-misc/mico: DoS in <2.3.12 (version bump)
Summary: net-misc/mico: DoS in <2.3.12 (version bump)
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: High enhancement (vote)
Assignee: Gentoo Security
URL:
Whiteboard: B3 [noglsa masked] DerCorny
Keywords: EBUILD, PMASKED
: 133532 (view as bug list)
Depends on:
Blocks:
 
Reported: 2006-02-08 09:01 UTC by Jean-Michel Smith
Modified: 2009-02-07 20:16 UTC (History)
5 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments
mico 2.3.12 ebuild (mico-2.3.12.ebuild,1.72 KB, text/plain)
2006-02-08 09:05 UTC, Jean-Michel Smith
no flags Details
mico-2.3.12-secfix1.diff (mico-2.3.12-secfix1.diff,547 bytes, patch)
2009-02-07 20:13 UTC, Robert Buchholz (RETIRED)
no flags Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Jean-Michel Smith 2006-02-08 09:01:48 UTC
I have put together a working ebuild for 2.3.12

In addition to features of the 2.3.11 and earlier ebuilds, this one also supports the "threads" USE flag, allowing one to compile mico with or without thread support.  This is important for us, as our inhouse software works far better with threads disabled.
Comment 1 Jean-Michel Smith 2006-02-08 09:05:24 UTC
Created attachment 79239 [details]
mico 2.3.12 ebuild

ebuild file
Comment 2 Luca Barbato gentoo-dev 2006-02-08 14:57:35 UTC
gtk dep isn't present
Comment 3 Jakub Moc (RETIRED) gentoo-dev 2006-05-16 13:32:58 UTC
*** Bug 133532 has been marked as a duplicate of this bug. ***
Comment 4 Doug Goldstein (RETIRED) gentoo-dev 2006-06-24 08:17:24 UTC
Does this use QT3 or QT4? Their own docs aren't too clear.
Comment 5 Tristan Heaven (RETIRED) gentoo-dev 2006-06-26 04:57:35 UTC
cardoe, your use.local.desc entry is wrong.

net-misc/mico - Enable QT GUI Toolkit (remove when package leaves portage or is fixed)
Comment 6 Alec Warner (RETIRED) archtester gentoo-dev Security 2006-08-02 21:39:09 UTC
(In reply to comment #4)
> Does this use QT3 or QT4? Their own docs aren't too clear.
> 

looks like 3..
Comment 7 Alec Warner (RETIRED) archtester gentoo-dev Security 2006-08-02 21:52:52 UTC
ebuild uses QTDIR without inheriting qt3 or qt4 eclass.
Comment 8 Doug Goldstein (RETIRED) gentoo-dev 2006-08-09 11:35:20 UTC
I fixed qt and tcltk USE flag issues.
Comment 9 Doug Goldstein (RETIRED) gentoo-dev 2006-08-09 11:38:04 UTC
There's an outstanding security bug... 

http://www.mico.org/down.html
Comment 10 Alec Warner (RETIRED) archtester gentoo-dev Security 2006-08-09 12:35:55 UTC
can we get this stable?  I'm not particuarly keen on stabling/keeping stuff that no one is maintaining.
Comment 11 Stefan Cornelius (RETIRED) gentoo-dev 2006-08-09 13:29:14 UTC
alpha, x86: please check if the ebuild looks good. If it does, please test, commit and stable it, since we have no maintainer here.

If it doesnt look clean or you dont want it stable, just say that and we'll find another solution (thats probably masking and killing, if no maintainer can be found)
Comment 12 Joshua Jackson (RETIRED) gentoo-dev 2006-08-09 21:28:38 UTC
lots of nice fun errors on x86 for building. Missing headers for one it appears. such as qapp, qsocknot, qtmico... I'll probably give more info later, but for now I'm gone for the night.
Comment 13 Jesus Rivero (Neurogeek) 2006-08-19 19:50:49 UTC
Hello, Just as Joshua stated, i was also unable to compile mico-2.3.12 for x86 with the following error messages:


c++  -I. -I../include  -O2  -Wall -Os -mcpu=i686 -pipe    -I/usr/include/gtk-1.2 -I/usr/include/glib-1.2 -I/usr/lib/glib/include   -c qtmico.cc -o qtmico.o
In file included from qtmico.cc:29:
../include/mico/qtmico.h:33:18: qapp.h: No such file or directory
../include/mico/qtmico.h:39:22: qsocknot.h: No such file or directory
../include/mico/qtmico.h:42:20: qtimer.h: No such file or directory
In file included from qtmico.cc:29:
../include/mico/qtmico.h:49: error: syntax error before `{' token
../include/mico/qtmico.h:53: error: syntax error before `public'
../include/mico/qtmico.h:56: error: destructors must be member functions
../include/mico/qtmico.h: In function `QTDispatcher* get_dispatcher()':
../include/mico/qtmico.h:60: error: `qtd_' undeclared (first use this function)
../include/mico/qtmico.h:60: error: (Each undeclared identifier is reported
   only once for each function it appears in.)

Comment 14 Bryan Østergaard (RETIRED) gentoo-dev 2006-08-27 22:51:06 UTC
Broken on Alpha the same way as x86. We have other corba implementations in portage so I'll vote for masking + removing if nobody wants to maintain mico.
Comment 15 Joshua Jackson (RETIRED) gentoo-dev 2006-08-28 19:55:44 UTC
It's masked for now for security. Nothing in the tree depends on it etc etc etc.
Comment 16 Joshua Jackson (RETIRED) gentoo-dev 2006-08-28 19:56:29 UTC
x86 is gone as this is now resolved in some way or form.
Comment 17 Fernando J. Pereda (RETIRED) gentoo-dev 2006-08-29 01:36:14 UTC
Bye bye mico...
Comment 18 Sune Kloppenborg Jeppesen (RETIRED) gentoo-dev 2006-08-29 11:16:00 UTC
Reassigning to Security.
Comment 19 Sune Kloppenborg Jeppesen (RETIRED) gentoo-dev 2006-09-05 05:46:50 UTC
Sending it to enhancement scope pending complete removal.
Comment 20 Alec Warner (RETIRED) archtester gentoo-dev Security 2006-09-18 22:16:11 UTC
Punted in 30 days (Oct 16th)
Comment 21 Charlie Shepherd (RETIRED) gentoo-dev 2006-11-25 15:43:42 UTC
Punted by phreak a while back...
Comment 22 Sune Kloppenborg Jeppesen (RETIRED) gentoo-dev 2006-11-26 10:40:44 UTC
Thx masterdriverz but please don't close security bugs:-)

Security please vote for mask GLSA.
Comment 23 Wolf Giesen (RETIRED) gentoo-dev 2006-11-27 02:58:40 UTC
We might be in for some laughter if we surface with a maskglsa for this one now ... I tend to vote NO.
Comment 24 Charlie Shepherd (RETIRED) gentoo-dev 2006-11-27 05:20:21 UTC
(In reply to comment #22)
> Thx masterdriverz but please don't close security bugs:-)
Sorrry, didn't think
Comment 25 Matthias Geerdsen (RETIRED) gentoo-dev 2006-11-27 06:53:55 UTC
joining frilled (0.5 no)
Comment 26 Sune Kloppenborg Jeppesen (RETIRED) gentoo-dev 2006-11-27 07:01:03 UTC
Voting full NO and closing. Feel free to reopen if you disagree.
Comment 27 Daniel Tourde 2006-12-02 12:05:03 UTC
Hello,

It seems that I am arriving after the battle but here is my situation. I am trying to create an ebuild for OpenFOAM, A Computer Fluid Dynamics (CFD) toolbox. The beast comes with it's own mico (2.3.11) but I had hoped to avoid to use that one and use instead the Gentoo one (maintained, well I had hoped...)
I am discovering now that mico is removed... 

How to solve that? I need OpenFOAM and I am not really willing to get a flawed mico in the system but what can be done?

Daniel
Comment 28 Oliver Borm 2007-11-04 22:55:12 UTC
As this is a dependency of OpenFOAM, I've added this ebuild to the sunrise overlay.
Comment 29 Robert Buchholz (RETIRED) gentoo-dev 2007-11-04 23:06:33 UTC
(In reply to comment #28)
> As this is a dependency of OpenFOAM, I've added this ebuild to the sunrise
> overlay.

Did you also fix the code issues raised in this bug?
Comment 30 Oliver Borm 2007-11-05 08:06:14 UTC
I've dropped the qt USE-Flag, if you meant that.
Comment 31 Michael Haubenwallner (RETIRED) gentoo-dev 2009-02-07 17:24:22 UTC
(In reply to comment #9)
> There's an outstanding security bug... 

Is this known to be fixed in 2.3.12 (and thus in 2.3.13)? (see bug#257984)
Comment 32 Robert Buchholz (RETIRED) gentoo-dev 2009-02-07 20:13:11 UTC
Created attachment 181281 [details, diff]
mico-2.3.12-secfix1.diff

The upstream patch for the security bug.
Comment 33 Robert Buchholz (RETIRED) gentoo-dev 2009-02-07 20:16:51 UTC
The patch is applied in 2.3.13, but it seems 2.3.12 is affected. Putting 2.3.13 is not unreasonable from a security POV.