Hi, on systems with e.g. noexec on /tmp, qgit can't run without telling it to use QProcess. This relies in src/dataloader.c. The README file says: In case of portability issues it is possible to fallback on a standard QProcess based interface. To do this uncomment USE_QPROCESS define in 'src/dataloader.h' before to compile. BTW i would say it is the expected behaviour in a Qt app. Furthermore, the way /tmp is handled is insecure since qgit open() a /tmp file (pattern: /tmp/qgit_135422384.txt and /tmp/qgit_135422384.sh) and follows symlinks without checking for prior existence. Eventually, it unlink() the symlinks. I am separately emailing qgit upstream (Macro Costalba).
Did you check 2.0_rc versions as well? Maybe it's fixed there already...
(In reply to comment #1) > Did you check 2.0_rc versions as well? Maybe it's fixed there already... > I only checked the source code. I was just checking it out and compiling it.
(In reply to comment #1) > Did you check 2.0_rc versions as well? Maybe it's fixed there already... > git4 (which is not in portage). It has been fixed on 2007-04-22 13:21:28 between the 2pre1 and 2pre2 versions: http://git.kernel.org/?p=qgit/qgit4.git;a=commitdiff;h=64749feedb5ece1b3ea9cc462ab61b0dc7051975 The upstream qgit git repository is still affected: http://git.kernel.org/?p=qgit/qgit.git;a=blob_plain;f=src/dataloader.cpp;hb=HEAD
This is about qgit instead of git
(In reply to comment #4) > This is about qgit instead of git > of course, one letter seems to have vanished :)
Dan Horák of Fedora has noticed a further impact: QGit then executes /tmp/qgit_XXXXXXX.sh, which could have been changed by the attacker (I haven't tested this second issue). Thanks to him. This rises the bug severity. Marco (upstream) has acknowledged the issue and he will provide a patch very soon.
Upstream fixed this issue in version 1.5.7 which has been released a few days ago.
ebuild in CVS
Thanks Jokey. Arches, please test and stabilize qgit-1.5.7. Targets are: "amd64 ppc ppc64 x86"
x86 stable
ppc stable
1. Emerges on AMD64. 2. No collisions. 3. Test phase ok. 4. Works. Portage 2.1.3.9 (default-linux/amd64/2007.0/desktop, gcc-4.1.2, glibc-2.5-r4, 2.6.22-gentoo-r5 x86_64) ================================================================= System uname: 2.6.22-gentoo-r5 x86_64 Intel(R) Pentium(R) D CPU 3.00GHz Timestamp of tree: Tue, 18 Sep 2007 20:50:01 +0000 ccache version 2.4 [enabled] app-shells/bash: 3.2_p17 dev-java/java-config: 1.3.7, 2.0.33-r1 dev-lang/python: 2.4.4-r4 dev-python/pycrypto: 2.0.1-r6 dev-util/ccache: 2.4-r7 sys-apps/baselayout: 1.12.9-r2 sys-apps/sandbox: 1.2.17 sys-devel/autoconf: 2.13, 2.61 sys-devel/automake: 1.5, 1.6.3, 1.7.9-r1, 1.8.5-r3, 1.9.6-r2, 1.10 sys-devel/binutils: 2.17-r1 sys-devel/gcc-config: 1.3.16 sys-devel/libtool: 1.5.24 virtual/os-headers: 2.6.21 ACCEPT_KEYWORDS="amd64" CBUILD="x86_64-pc-linux-gnu" CFLAGS="-O2 -march=nocona -pipe" CHOST="x86_64-pc-linux-gnu" CONFIG_PROTECT="/etc /usr/kde/3.5/env /usr/kde/3.5/share/config /usr/kde/3.5/shutdown /usr/share/X11/xkb /usr/share/config" CONFIG_PROTECT_MASK="/etc/env.d /etc/env.d/java/ /etc/gconf /etc/init.d /etc/pam.d /etc/revdep-rebuild /etc/terminfo /etc/udev/rules.d" CXXFLAGS="-O2 -march=nocona -pipe" DISTDIR="/usr/portage/distfiles" EMERGE_DEFAULT_OPTS="-k" FEATURES="ccache collision-protect distlocks metadata-transfer multilib-strict parallel-fetch sandbox sfperms strict test unmerge-orphans userfetch userpriv usersandbox" GENTOO_MIRRORS="http://thor ftp://mirrors1.netvisao.pt/gentoo http://darkstar.ist.utl.pt/pub/gentoo http://distfiles.gentoo.org http://www.ibiblio.org/pub/Linux/distributions/gentoo" MAKEOPTS="-j3" PKGDIR="/usr/portage/packages" PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress --force --whole-file --delete --delete-after --stats --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages --filter=H_**/files/digest-*" PORTAGE_TMPDIR="/var/tmp" PORTDIR="/usr/portage" SYNC="rsync://thor/gentoo-portage" USE="X acl acpi alsa amd64 arts bash-completion bitmap-fonts branding cairo cdr cli cracklib crypt dbus dri dts dvd dvdr dvdread eds emboss encode evo fam firefox flac gdbm gif gpm hal iconv ipv6 isdnlog jpeg kde kdeenablefinal kdehiddenvisibility mad midi mikmod mmx mp3 mpeg mudflap musepack musicbrainz ncurses nptl nptlonly offensive ogg opengl openmp pam pcre pdf perl png postgres pppd python qt3 qt3support qt4 quicktime readline reflection sdl session spell spl sse sse2 ssl svg tcpd test tiff truetype truetype-fonts type1-fonts unicode vorbis xcomposite xinerama xml xorg xscreensaver xv zlib" ALSA_CARDS="ali5451 als4000 atiixp atiixp-modem bt87x ca0106 cmipci emu10k1x ens1370 ens1371 es1938 es1968 fm801 hda-intel intel8x0 intel8x0m maestro3 trident usb-audio via82xx via82xx-modem ymfpci" ALSA_PCM_PLUGINS="adpcm alaw asym copy dmix dshare dsnoop empty extplug file hooks iec958 ioplug ladspa lfloat linear meter mulaw multi null plug rate route share shm softvol" ELIBC="glibc" INPUT_DEVICES="keyboard mouse" KERNEL="linux" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" USERLAND="GNU" VIDEO_CARDS="i810" Unset: CTARGET, INSTALL_MASK, LANG, LC_ALL, LDFLAGS, LINGUAS, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS, PORTDIR_OVERLAY
amd64 stable
ppc64 stable
last arch, ready for glsa.
glsa request filed.
GLSA 200710-05, thanks everyone.
