Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 245921 (CVE-2008-4976) - <media-video/ogle-0.9.2-r2 symlink attack (CVE-2008-4976)
Summary: <media-video/ogle-0.9.2-r2 symlink attack (CVE-2008-4976)
Status: RESOLVED FIXED
Alias: CVE-2008-4976
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: High minor (vote)
Assignee: Gentoo Security
URL: http://bugs.debian.org/496425
Whiteboard: B3 [noglsa]
Keywords:
Depends on:
Blocks: debian-tempfile
  Show dependency tree
 
Reported: 2008-11-07 02:23 UTC by Stefan Behte (RETIRED)
Modified: 2009-04-06 16:06 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Stefan Behte (RETIRED) gentoo-dev Security 2008-11-07 02:23:36 UTC 
CVE-2008-4976 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-4976):
  ogle 0.9.2 and ogle-mmx 0.9.2 allow local users to overwrite
  arbitrary files via a symlink attack on (a) /tmp/ogle_audio.#####,
  (b) /tmp/ogle_cli.#####, (c) /tmp/ogle_ctrl.#####, (d)
  /tmp/ogle_gui.#####, (e) /tmp/ogle_mpeg_ps.#####, (f)
  /tmp/ogle_mpeg_vs.#####, (g) /tmp/ogle_nav.#####, and (h)
  /tmp/ogle_vout.#####, temporary files, related to the (1)
  ogle_audio_debug, (2) ogle_cli_debug, (3) ogle_ctrl_debug, (4)
  ogle_gui_debug, (5) ogle_mpeg_ps_debug, (6) ogle_mpeg_vs_debug, (7)
  ogle_nav_debug, and (8) ogle_vout_debug scripts.
Comment 1 Stefan Behte (RETIRED) gentoo-dev Security 2008-11-07 02:29:54 UTC 
DEBIAN: http://bugs.debian.org/496425
DEBIAN: http://bugs.debian.org/496420
FILES: ogle_audio_debug, ogle_cli_debug, ogle_ctrl_debug, ogle_gui_debug,
ogle_mpeg_ps_debug, ogle_mpeg_vs_debug, ogle_nav_debug, ogle_vout_debug
CODE: http://dev.gentoo.org/~rbu/security/debiantemp/ogle
CODE: http://dev.gentoo.org/~rbu/security/debiantemp/ogle-mmx
NOTE: This only affects debugging scripts not present in standard path

I checked it: our in-tree version 0.9.2-r1 is vulnerable.
Comment 2 Stefan Behte (RETIRED) gentoo-dev Security 2008-11-30 16:28:10 UTC 
media-video: *ping*
Comment 3 Alex Legler (RETIRED) archtester gentoo-dev Security 2009-04-04 16:40:32 UTC 
Arches, please test and mark stable:
=media-video/ogle-0.9.2-r2
Target keywords : "alpha amd64 ia64 ppc sparc x86"
Comment 4 Tobias Klausmann (RETIRED) gentoo-dev 2009-04-05 10:52:09 UTC 
Stable on alpha.
Comment 5 Brent Baude (RETIRED) gentoo-dev 2009-04-05 13:59:44 UTC 
ppc done
Comment 6 Raúl Porcel (RETIRED) gentoo-dev 2009-04-06 13:02:15 UTC 
ia64/sparc/x86 stable
Comment 7 Alex Legler (RETIRED) archtester gentoo-dev Security 2009-04-06 15:17:53 UTC 
amd64 stable.
Vulnerable version removed.
Ready for voting, I say NO.
Comment 8 Robert Buchholz (RETIRED) gentoo-dev 2009-04-06 16:06:22 UTC 
this is only in debug scripts, so i'd vote NO as well.