PADL MigrationTools 46 creates temporary files insecurely, which allows local users to overwrite arbitrary files via a symlink attack on the temporary files, which are not properly created by (1) migrate_all_online.sh, (2) migrate_all_offline.sh, (3) migrate_all_netinfo_online.sh, (4) migrate_all_netinfo_offline.sh, (5) migrate_all_nis_online.sh, (6) migrate_all_nis_offline.sh, (7) migrate_all_nisplus_online.sh, and (8) migrate_all_nisplus_offline.sh. http://www.frsirt.com/english/advisories/2005/2427 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=338920
robbat2 pls provide an updated ebuild btw, debian has fixed this in http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=338920
Robbat/Grant please have look at this
Robin? Grant? this bug has now been open for over one month without reaction
*** Bug 154481 has been marked as a duplicate of this bug. ***
It has been over a month(!) without any comment from maintainers now. If somebody has no time to extract patches or provide an ebuild, then at least leave a comment stating that.
my opinion is to dump the package anyway.
Dumping it would solve this problem as well. Could we get it masked until treecleaners come about to do their work. Comments?
masked in cvs now.
Time for GLSA decision. I vote NO.
Hm, I think it would be nice to let people know when we bestow security masking on a package.
frilled: it's masked for tree-cleaners, see bug 154988
Not sure why this is not in glsa? status.
I see migrationtools is scheduled for removal. So what's the alternative??? Should I put migrationtools in a portage overlay now? $ emerge -p migrationtools These are the packages that would be merged, in order: Calculating dependencies !!! All ebuilds that could satisfy "migrationtools" have been masked. !!! One of the following masked packages is required to complete your request: - net-nds/migrationtools-45 (masked by: package.mask, ~x86 keyword) # Robin H. Johnson <robbat2@gentoo.org> (21 Nov 2006) # bug #149660, scheduled for removal 2006-Dec-21. - net-nds/migrationtools-44-r2 (masked by: package.mask) - net-nds/migrationtools-44-r1 (masked by: package.mask) - net-nds/migrationtools-46 (masked by: package.mask) - net-nds/migrationtools-45-r1 (masked by: package.mask, ~x86 keyword)
Evert: migrationtools is the sort of application you use once, and don't need afterwards. If you do want to use it, just unpack it on your machine, edit the files to put the configuration stuff (that you need to do anyway with the ebuild), use the conversion scripts, and then delete them.
/me tends to vote no
I like the convenience of (de)installing *everything* using emerge :) And other than that, I think it's kinda lame to remove a package because of a security issue which is already fixed by other distros...
Evert: since one has to edit several of the migrationtools files to use them, emerge --unmerge wouldn't remove them anyway as the hashes recorded in /var/db/pkg/..../CONTENTS would have changed.
That's where u have a point ;-)
security pls vote
apprentice - no on GLSA
I also tend to vote no.
2+ NO votes -> no GLSA. I'll keep this one open until the package is completely removed.
Jokey reports the package has been removed, noglsa so RESOLVED FIXED. Thanks everyone.
