Bug 507024 (CVE-2001-1593)

Summary:	<app-text/a2ps-4.14-r6 : insecure temporary file use (CVE-2001-1593)
Product:	Gentoo Security	Reporter:	Agostino Sarubbo <ago>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	minor	CC:	cjk
Priority:	Normal	Flags:	stable-bot: sanity-check+
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:	B4 [noglsa cve]
Package list:	=app-text/a2ps-4.14-r6	Runtime testing required:	---

Description Agostino Sarubbo gentoo-dev

2014-04-07 09:13:42 UTC

CVE-2001-1593 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2001-1593):

The tempname_ensure function lib/routines.h in a2ps 4.14 and earlier, as used by the spy_user function and possibly other functions, allows local users to modify arbitrary files via a symlink attack on a temporary file.


@maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.

Comment 1 Manuel Rüger (RETIRED) gentoo-dev

2015-08-27 18:20:26 UTC

A patch is available here:
https://bugs.debian.org/cgi-bin/bugreport.cgi?filename=a2ps-4.14-1.3-nmu.diff;att=1;bug=742902;msg=12

Comment 2 Thomas Deutschmann (RETIRED) gentoo-dev

2017-01-21 16:32:53 UTC

@ Maintainer(s): Upstream didn't work on the project since 2007. So let's add Debian's patch to get rid of this vulnerability. I prepared https://github.com/gentoo/gentoo/pull/3579 -- Please comment/approve/decline.

Comment 3 Matthias Maier gentoo-dev

2017-01-24 03:11:59 UTC

Approved and applied. Thanks!


commit 1802efb0b659c231f5e3c7c9e275603e6ae3c585
Author: Matthias Maier <tamiko@gentoo.org>
Date:   Mon Jan 23 21:06:31 2017 -0600

    app-text/a2ps: drop vulnerable, bug #507024
    
    Package-Manager: Portage-2.3.0, Repoman-2.3.1

commit d78cf9b0a31ec3209bdc43b2dcabe0606ff6af13
Author: Thomas Deutschmann <whissi@gentoo.org>
Date:   Sat Jan 21 17:28:53 2017 +0100

    app-text/a2ps: Add patch for CVE-2001-1593 (bug #507024)
    
    Package-Manager: Portage-2.3.3, Repoman-2.3.1
    Signed-off-by: Matthias Maier <tamiko@gentoo.org>

Comment 4 Aaron Bauman (RETIRED) gentoo-dev

2017-01-24 03:17:23 UTC

@arches, please stabilize.

Comment 5 Jeroen Roovers (RETIRED) gentoo-dev

2017-01-24 05:21:45 UTC

Stable for HPPA PPC64.

Comment 6 Agostino Sarubbo gentoo-dev

2017-01-24 09:06:22 UTC

amd64 stable

Comment 7 Agostino Sarubbo gentoo-dev

2017-01-24 10:57:06 UTC

x86 stable

Comment 8 Tobias Klausmann (RETIRED) gentoo-dev

2017-01-25 19:21:34 UTC

Stable on alpha.

Comment 9 Agostino Sarubbo gentoo-dev

2017-01-26 10:22:59 UTC

sparc stable

Comment 10 Agostino Sarubbo gentoo-dev

2017-01-26 11:00:59 UTC

ppc stable

Comment 11 Agostino Sarubbo gentoo-dev

2017-01-26 15:28:55 UTC

ia64 stable

Comment 12 Markus Meier gentoo-dev

2017-02-05 16:54:56 UTC

arm stable, all arches done.

Comment 13 Aaron Bauman (RETIRED) gentoo-dev

2017-02-06 00:51:29 UTC

@maintainer(s), please clean the vulnerable version.

GLSA Vote: No

Comment 14 Andreas K. Hüttel archtester

2017-02-19 18:37:05 UTC

Cleanup done

Comment 15 Thomas Deutschmann (RETIRED) gentoo-dev

2017-02-21 14:11:09 UTC

Repository is clean, all done.