Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 97593 - mail-client/drac <= 1.12-r1 insecure debug file creation
Summary: mail-client/drac <= 1.12-r1 insecure debug file creation
Status: RESOLVED INVALID
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Auditing (show other bugs)
Hardware: All Linux
: High normal (vote)
Assignee: Gentoo Security
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2005-07-01 02:41 UTC by Romang
Modified: 2006-12-27 01:18 UTC (History)
0 users

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Romang 2005-07-01 02:41:11 UTC 
Hello,

Calculating dependencies ...done!
[ebuild  N    ] mail-client/drac-1.12-r1  -debug 0 kB

Take a look on :

rpc.dracd.c

111 #ifdef DEBUG
112     debugf = fopen("/var/tmp/drac.debug", "a+");

201 #ifdef DEBUG
202         fprintf(debugf, "Select bits: %x\n", svc_fdset.fds_bits[0]);
203         fflush(debugf);

Regards.
Comment 1 Tavis Ormandy (RETIRED) gentoo-dev 2005-07-05 06:27:30 UTC 
Please report this issue upstream, the gentoo security precedent on insecure 
debugging code is to mark INVALID.
Comment 2 Tavis Ormandy (RETIRED) gentoo-dev 2005-07-05 06:27:53 UTC 
fixing status...
Comment 3 Tavis Ormandy (RETIRED) gentoo-dev 2005-07-05 06:28:08 UTC 
=>INVALID