Summary: | <dev-libs/opencryptoki-2.4.2: insecure lock files handling in /tmp and /var/tmp (CVE-2012-{4454,4455}) | ||
---|---|---|---|
Product: | Gentoo Security | Reporter: | Agostino Sarubbo <ago> |
Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
Status: | RESOLVED FIXED | ||
Severity: | trivial | CC: | flameeyes |
Priority: | Normal | ||
Version: | unspecified | ||
Hardware: | All | ||
OS: | Linux | ||
URL: | http://www.openwall.com/lists/oss-security/2012/09/07/2 | ||
Whiteboard: | ~3 [noglsa] | ||
Package list: | Runtime testing required: | --- |
Description
Agostino Sarubbo
2012-09-27 19:01:21 UTC
CVE-2012-4455 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-4455): openCryptoki 2.4.1 allows local users to create or set world-writable permissions on arbitrary files via a symlink attack on the (1) LCK..opencryptoki or (2) LCK..opencryptoki_stdll file in /var/lock/. CVE-2012-4454 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-4454): openCryptoki before 2.4.1, when using spinlocks, allows local users to create or set world-writable permissions on arbitrary files via a symlink attack on the (1) .pkapi_xpk or (2) .pkcs11spinloc file in /tmp. opencryptoki-2.4.2 in tree. flameeyes: All your backports are in as far as I could see, and of course the broke build again... one small patch. I remember you have a working device, can you please check? I got a device, as for 'working' it might be stretching it. Will check tomorrow, thanks for working on this, I lost motivation to work with IBM along the way. (In reply to comment #3) > I got a device, as for 'working' it might be stretching it. Will check > tomorrow, thanks for working on this, I lost motivation to work with IBM > along the way. I fully understand what you mean in this case! Filed a bug[1] with patch. [1] https://sourceforge.net/tracker/?func=detail&atid=710344&aid=3596346&group_id=128009 crypto done. Thanks, everyone. Closing noglsa for ~arch only. |