| Summary: | sci-electronics/geda <1.4.0-r1 sch2eaglepos.sh insecure temporary file creation (CVE-2008-5148) | ||
|---|---|---|---|
| Product: | Gentoo Security | Reporter: | stupendoussteve |
| Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
| Status: | RESOLVED FIXED | ||
| Severity: | minor | CC: | sci-electronics, seventhguardian |
| Priority: | High | ||
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | Linux | ||
| URL: | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-5148 | ||
| Whiteboard: | B3 [glsa] | ||
| Package list: | Runtime testing required: | --- | |
|
Description
stupendoussteve
2008-11-19 04:29:44 UTC
OK, I'll have a look at it. I'm normally away right now but I'm going to have some unexpected availability in the coming days. Denis. The fix is now in CVS. Sorry for the delay. Security, feel free to go forward and close this bug whenever you want. Denis. Arches please test and stabilize the fixed version. Lets try this again... Arches please test and stabilize the fixed version. To clarify, fixed version is geda-1.4.1, target keywords "amd64 ppc sparc x86" Thanks. (In reply to comment #6) > To clarify, fixed version is geda-1.4.1, target keywords "amd64 ppc sparc x86" No. I fixed 1.4.0 and used the same sed for 1.4.1 when I added it, which was after fixing 1.4.0. If arches want to stabilize 1.4.1 they have my blessing (although it hasn't been in the tree for a month yet, far from that), but that has nothing to do with the current security issue and should probably be dealt with in another bug. Denis. Um, do I get this right that you've changed the current stable ebuild to fix that bug? I highly doubt this was a good idea. First, it could've lead to breakage (maybe arch-specific), which would not have been caught by the arch testing process. Luckily, this has apparently not been the case, but one issue is still remaining: We can't give users sane instructions how to fix that bug -- remerge the package? Does not sound like a good idea. Please either provide an -r1 version of the 1.4.0 ebuild (as an exact copy, not sure about KEYWORDS then though) or give your explicit ok for stabling 1.4.1 and avoid changing stable ebuilds (or maybe non-p.mask'ed packages in general) in the future, especially in case of security problems. Sorry if I got this all wrong, please don't feel offended, I'm just trying to get the bug resolved properly. :) Thanks ;) Removing arches and reverting whiteboard to [ebuild] until I / somebody else knows what exactly is the case. :) (In reply to comment #8) > Sorry if I got this all wrong, please don't feel offended, I'm just trying to > get the bug resolved properly. :) No worries, I clearly screwed up. I'm currently away and fixed that from my hotel room and forgot to revbump in the process. Feel free to revbump now if you want, or I'll do it in 14 hours when I'll have a better connection. Sorry about this. Denis. (In reply to comment #8) > Please either provide an -r1 version of the 1.4.0 ebuild (as an exact copy, not > sure about KEYWORDS then though) or give your explicit ok for stabling 1.4.1 > and avoid changing stable ebuilds (or maybe non-p.mask'ed packages in general) > in the future, especially in case of security problems. Done, and straight to stable as the change is really minor in a rarely used function of a package used by few people only. Sorry again about the mess. Denis. The script is installed to /usr/bin, so I vote YES. I vote no, as it's "just" a symlink attack on a script which is barely used. yes too, request filed. GLSA 200903-08 |
