Bug 458898 – <net-analyzer/pktstat-1.8.5-r1: writes content from TCP streams to public readable file /tmp/smtp.log (CVE-2013-0350)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Agostino Sarubbo 2013-02-23 19:06:18 UTC]

From ${URL} :

I noticed pktstat creates a file with a fixed name in /tmp and writes
debugging
info gathered from the sniffed TCP streams into it:

redacted:/tmp# ls -al smtp.log
-rw-r--r-- 1 root root 236726 Feb 22 21:30 smtp.log

[Comment 1 GLSAMaker/CVETool Bot 2014-08-19 22:37:05 UTC]

CVE-2013-0350 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-0350):
  tmp_smtp.c in pktstat 1.8.5 allows local users to overwrite arbitrary files
  via a symlink attack on /tmp/smtp.log.

[Comment 2 Jeroen Roovers (RETIRED) 2014-08-20 08:08:42 UTC]

-r1 removes all functions calls setting up and writing to that debug file.

Arch teams, please test and mark stable:
=net-analyzer/pktstat-1.8.5-r1
Targeted stable KEYWORDS : amd64 x86

[Comment 3 Agostino Sarubbo 2014-08-20 15:50:05 UTC]

amd64 stable

[Comment 4 Agostino Sarubbo 2014-08-20 16:00:05 UTC]

x86 stable.

Maintainer(s), please cleanup.
Security, please vote.

[Comment 5 Kristian Fiskerstrand (RETIRED) 2014-08-20 20:23:22 UTC]

GLSA vote: No

[Comment 6 Yury German 2014-08-20 21:13:28 UTC]

Arches, Thank you for your work
Maintainer(s), please drop the vulnerable version.

GLSA Vote: No

[Comment 7 Yury German 2014-08-25 16:26:26 UTC]

Maintainer(s), Thank you for cleanup!

No GLSA - Closing Bug as Resolved