First Last Prev Next    No search results available      Search page      Enter new bug
Bug#: 66357
Alias:
Product:
Component:
Status: RESOLVED
Resolution: FIXED
Assigned To: Gentoo Security <security@gentoo.org>
Hardware:
OS:
Version:
Priority:
Severity:
Reporter: Luke Macken (RETIRED) <lewk@gentoo.org>
Add CC:
CC:
Remove selected CCs
URL:
Summary:
Status Whiteboard:
Keywords:
Flags: Requestee:
 
 
  ()

Filename Description Type Creator Created Size Actions
ghostscript-7.07.1-tempfile.patch ghostscript-7.07.1-tempfile.patch patch Luke Macken (RETIRED) 2004-10-04 15:09 0000 3.03 KB Details | Diff
gs7.05.6-tempfile.patch gs7.05.6-tempfile.patch patch Luke Macken (RETIRED) 2004-10-08 20:18 0000 2.68 KB Details | Diff
Create a New Attachment (proposed patch, testcase, etc.) View All

Bug 66357 depends on: Show dependency tree
Bug 66357 blocks:
Votes: 0    Show votes for this bug    Vote for this bug

Additional Comments: (this is where you put emerge --info)


Not eligible to see or edit group visibility for this bug.






View Bug Activity   |   Format For Printing   |   XML   |   Clone This Bug

Description:   Opened: 2004-10-04 15:08 0000 
Problem description:

  Trustix Security Engineers identified that all these packages had one or
  more script(s) that handled temporary files in an insecure manner.  While
  it is not believed that any of these holes could lead to privilege
  escalation, it would be possible to trick the scripts to overwrite data
  writable by the user that invokes the script.

  These problems can only be exploited by local users, and they would have to
  wait for someone else, preferably root, to run the vulnerable scripts.

------- Comment #1 From Luke Macken (RETIRED) 2004-10-04 15:09:36 0000 ------- 
Created an attachment (id=41096) [details]
ghostscript-7.07.1-tempfile.patch

Trustix patch to fix insecure tempfile handling.

------- Comment #2 From Luke Macken (RETIRED) 2004-10-04 15:10:11 0000 ------- 
printing herd,

please verify and apply patch if necessary.

------- Comment #3 From Heinrich Wendel (RETIRED) 2004-10-07 08:10:10 0000 ------- 
added ghostscript-7.07.1-r7 to portage, but there is still ghostscript-7.05.6
which is required for ppc, see bug #49227, it may be vulnerable as well, but
the patch does not apply there

------- Comment #4 From Luke Macken (RETIRED) 2004-10-07 08:18:09 0000 ------- 
archs, please mark ghostscript-7.07.1-r7 stable.

------- Comment #5 From Gustavo Zacarias (RETIRED) 2004-10-07 10:19:50 0000 ------- 
sparc tasty.

------- Comment #6 From Jeremy Huddleston (RETIRED) 2004-10-07 14:54:31 0000 ------- 
stable amd64

------- Comment #7 From Bryan Østergaard (RETIRED) 2004-10-07 15:44:11 0000 ------- 
Stable on alpha.

------- Comment #8 From Guy Martin 2004-10-07 16:47:50 0000 ------- 
hppa happy

------- Comment #9 From Olivier Crete 2004-10-07 17:33:03 0000 ------- 
x86 is there

------- Comment #10 From SpanKY 2004-10-07 18:47:45 0000 ------- 
ia64 stable

------- Comment #11 From Thierry Carrez (RETIRED) 2004-10-08 00:57:06 0000 ------- 
We'll need a patch that would apply to a ppc-compatible version of ghostscript
(7.05.06) to fix it for ppc as well. Back to ebuild status to solve the ppc
case.

------- Comment #12 From Luke Macken (RETIRED) 2004-10-08 20:18:17 0000 ------- 
Created an attachment (id=41402) [details]
gs7.05.6-tempfile.patch

Patch to fix tempfile vulnerabilities in 7.05.6 (ppc)

------- Comment #13 From Tom Gall 2004-10-09 19:59:34 0000 ------- 
stable on ppc64, thanks!

(The comments about ppc leave me somewhat stunned...  if the 7.07.1-r7 version works just fine with ppc64, so should ppc, least so I owuld think unless there is some bug I just haven't hit yet waiting out there in the weeds for some poor unsuspecting ppc64 user)

------- Comment #14 From Luke Macken (RETIRED) 2004-10-09 22:43:08 0000 ------- 
printing herd,

please apply tempfile patch to 7.05.6 for ppc.

------- Comment #15 From Hardave Riar (RETIRED) 2004-10-16 21:45:40 0000 ------- 
Stable on mips

------- Comment #16 From Luke Macken (RETIRED) 2004-10-17 20:52:05 0000 ------- 
Ready to draft GLSA.

------- Comment #17 From Thierry Carrez (RETIRED) 2004-10-18 06:16:19 0000 ------- 
This can't be at GLSA status : still waiting for printing herd to apply
tempfile patch to a ppc-supported version... like 7.05.6-r2.

------- Comment #18 From Heinrich Wendel (RETIRED) 2004-10-18 11:20:08 0000 ------- 
added gs-7.05.6-r2 for ppc

------- Comment #19 From Luke Macken (RETIRED) 2004-10-18 11:53:22 0000 ------- 
ppc, please mark ghostscript-7.05.6-r2 stable.

------- Comment #20 From Jochen Maes (RETIRED) 2004-10-19 02:29:44 0000 ------- 
stable on ppc

------- Comment #21 From Thierry Carrez (RETIRED) 2004-10-19 05:15:34 0000 ------- 
Now we're set...

------- Comment #22 From Thierry Carrez (RETIRED) 2004-10-20 14:22:14 0000 ------- 
GLSA 200410-18
First Last Prev Next    No search results available      Search page      Enter new bug