Bug 191643

Summary:	app-crypt/coolkey < 1.1.0-r1 file and directory permission flaw (CVE-2007-4129)
Product:	Gentoo Security	Reporter:	Robert Buchholz (RETIRED) <rbu>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	trivial	CC:	crypto+disabled
Priority:	High
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	https://bugzilla.redhat.com/show_bug.cgi?id=251774
Whiteboard:	~3 [noglsa]
Package list:		Runtime testing required:	---

Description Robert Buchholz (RETIRED) gentoo-dev

2007-09-08 01:50:12 UTC

According to Steve Grubb in Redhat #251774:
  It looks like coolkey creates /tmp/.pk11ipc1 as a world writable directory
  without the sticky bit. And...it creates the files under that potentially as
  world writable with the execute bit turned on or uses the file without any
  sanity check. coolkey runs as root sometimes and that makes it susceptible to
  doing symlink attacks.

The only version in the tree is unstable at the moment, however.

Comment 1 Pierre-Yves Rofes (RETIRED) gentoo-dev

2007-09-08 07:58:20 UTC

seems that redhat issued a patch. crypto, please provide a fixed ebuild.

Comment 2 Alon Bar-Lev (RETIRED) gentoo-dev

2007-09-08 08:21:26 UTC

Added: coolkey-1.1.0-r1

Comment 3 Pierre-Yves Rofes (RETIRED) gentoo-dev

2007-09-08 09:03:27 UTC

thanks. closing without glsa.