497406 – dev-perl/Proc-Daemon: writes world-writable PID file

Bug 497406 - dev-perl/Proc-Daemon: writes world-writable PID file

Summary: dev-perl/Proc-Daemon: writes world-writable PID file

Status:	RESOLVED DUPLICATE of bug 494508

Alias:	None

Product:	Gentoo Security
Classification:	Unclassified
Component:	Vulnerabilities (show other bugs)
Hardware:	All Linux

Importance:	Normal minor (vote)
Assignee:	Gentoo Security

URL:	http://bugs.debian.org/732283
Whiteboard:	A4 [upstream]
Keywords:

Depends on:
Blocks:

Reported:	2014-01-07 15:29 UTC by Samuel Damashek (RETIRED)
Modified:	2014-01-10 09:45 UTC (History)
CC List:	1 user (show)

See Also:
Package list:
Runtime testing required:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Samuel Damashek (RETIRED) gentoo-dev

2014-01-07 15:29:42 UTC

From ${URL} :

Proc::Daemon, when instructed to write a pid file, does that with a
umask set to 0, so the pid file ends up with mode 666. This is a
rather stupid idea and may well be a security issue.


Upstream bug report: https://rt.cpan.org/Public/Bug/Display.html?id=91450
Debian patch: http://anonscm.debian.org/gitweb/?p=pkg-perl/packages/libproc-daemon-perl.git;a=blob;f=debian/patches/pid.patch

Comment 1 SpanKY gentoo-dev

2014-01-07 16:12:28 UTC

world readable isn't a security issue.  world writable is.

Comment 2 Mikle Kolyada (RETIRED) archtester

2014-01-10 09:45:08 UTC


*** This bug has been marked as a duplicate of bug 494508 ***