496544 – [sunrise] app-shells/rush (CVE-2013-6889)

Bug 496544 - [sunrise] app-shells/rush (CVE-2013-6889)

Summary: [sunrise] app-shells/rush (CVE-2013-6889)

Status:	RESOLVED DUPLICATE of bug 247631

Alias:	None

Product:	Gentoo Linux
Classification:	Unclassified
Component:	New packages (show other bugs)
Hardware:	All Linux

Importance:	Normal normal (vote)
Assignee:	Gentoo Linux bug wranglers

URL:
Whiteboard:
Keywords:

Depends on:	247631
Blocks:
	Show dependency tree

Reported:	2013-12-30 20:48 UTC by Florian Steinel
Modified:	2013-12-30 23:08 UTC (History)
CC List:	0 users

See Also:
Package list:
Runtime testing required:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Florian Steinel 2013-12-30 20:48:36 UTC

The sunrise ebuild for app-shells/rush (see Bug #247631) contains an security flaw.
See http://blog.steve.org.uk/a_good_week_.html and http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=733505 for Details.

Example (from the Debain Bug):

shelob ~ $ rush --lint /etc/shadow 2>&1| head -n 2
rush: Info: /etc/shadow:1: unknown statement: root:$6$zwJQWKVo$../Wg.rwXXitSyS8/.../:15884:0:99999:7:::
rush: Info: /etc/shadow:2: unknown statement: daemon:*:15884:0:99999:7:::

Comment 1 Jeroen Roovers (RETIRED) gentoo-dev

2013-12-30 23:08:21 UTC


*** This bug has been marked as a duplicate of bug 247631 ***