Bugzilla Bug 79725

Debian Security Advisory

DSA-661-1 f2c -- insecure temporary files

Date Reported:
    27 Jan 2005
Affected Packages:
    f2c
Vulnerable:
    Yes
Security database references:
    In Mitre's CVE dictionary: CAN-2005-0017, CAN-2005-0018.
More information:

    Javier Fernndez-Sanguino Pea from the Debian Security Audit project discovered that f2c and fc, which are both part of the f2c
    package, a fortran 77 to C/C++ translator, open temporary files insecurely and are hence vulnerable to a symlink attack. The Common
    Vulnerabilities and Exposures project identifies the following vulnerabilities:

      - CAN-2005-0017

        Multiple insecure temporary files in the f2c translator.

      - CAN-2005-0018

        Two insecure temporary files in the f2 shell script.

    For the stable distribution (woody) these problems have been fixed in version 20010821-3.1

    For the unstable distribution (sid) these problems will be fixed soon.

    We recommend that you upgrade your f2c package.



Reproducible: Always
Steps to Reproduce:

Danny, please commit the ebuild to portage.

*** Bug 77570 has been marked as a duplicate of this bug. ***

Ebuild commited and already marked stable on amd64, x86 and ppc.

sparc/Ferris: please confirm now that the ebuild is incvs
ppc64: please test and mark stable

Stable for sparc.  Tests OK.

GLSA vote... I don't see root using f2c that often, so I've mixed feelings.

I remember some package using it for compiling its Fortran sources. Probably
was one of the dependancies of sci-geosciences/grass.

I vote for no GLSA on this one. Last time I checked BASC there were no installs
at all.

What is BASC? How do you know nobody has installed f2c?

root@caravan:~# grep f2c /var/log/emerge.log |grep completed
1100311820:  ::: completed emerge (1 of 8) dev-libs/libf2c-20021004-r1 to /
1100311875:  ::: completed emerge (2 of 8) dev-lang/f2c-20030320 to /
root@caravan:~# 

I've recently switched over to gcc's Fortran compiler, but how can you be sure everybody else has?

Many scientist do use f2c even today because of very old and well working code
from the 60's !!!

BASC aka http://www.gentoo-stats.org/

Actually some systems use it now. Security please cast your vote.

f2c is commonly used by root when compiling some fortran packages in app-sci
that require it (e.g., ghemical) or optionally using it for fortran source
(anything in fortran, basically, can use f2c + cc instead of g77 or whatever
else).

Speaking of, is this vulnerability also present in libf2c?

I tend to vote YES on tmpfile vuln in packages that must/makesense being used
by root, and ebuilds may even automate the task, so I vote YES.

I vote for a GLSA, too.

OK, good arguments. 

wrt libf2c it does not seem to include f2c and fc. However I'm no f2c expert.

This still needs ppc64 stable marking.

sorry, bug #79884 avoids me from marking stable. new f2c itself seems to be
stable.  Markus

We need the keyword in.
Danny: could you put "ppc64" in KEYWORDS for corsair ? Would do it but I still need to get commit access :)

nigoro marked stable for me.

so now it is stable on ppc64

GLSA 200501-43