The default Linux config file for rdist still specifies a.out as the executable format. That essentially breaks the noexec option, as Linux switched to ELF ages ago. Attached is a patch to fix that. The patch also makes ssh the default transport if the "crypt" flag is used. It also fixes the yacc grammer so that bison can again be used. Finally, it installs the files as group root instead of bin and man. Reproducible: Always Steps to Reproduce: 1. 2. 3.
Created attachment 41367 [details, diff] patch to rdist-6.1.5-r1.ebuild to fix noexec option, plus bonus stuff
Here's a new patch that fixes a couple more problems: an insecure use of mktemp(3) and a segfault on 64-bit machines while trying to print an error message. It also changes the mention of a.out in the man page to ELF.
Created attachment 49049 [details, diff] patch to rdist-6.1.5-r1.ebuild
Created attachment 49051 [details, diff] patch to fix insecure mktemp use; put it in ${FILESDIR}/rdist_mkstemp.patch
This is the only open bug, but dead upstream (alpha release in 2001). I am unsure if other distros have dropped it yet, but I don't know of anyone still using it. I haven't tried said patch (or the alpha available from the upstream).
Security, looks like this package may use mktemp insecurely, can someone please double check for me? I'd like to punt it in either case, but I want a GLSA if one is necessary. Thanks.
(In reply to comment #6) > Security, looks like this package may use mktemp insecurely, can someone please > double check for me? I'd like to punt it in either case, but I want a GLSA if > one is necessary. > > Thanks. > only rdistvf.pl contains a weakness that can empty/override an arbitrary file with the rights of the user calling rdistvf.pl . But that file is never used, AFAIK. $tmp = "/tmp/rdistfilter.$$"; open(OUTF, "|sort >$tmp") || die "Can not open tmp file.\n"; These two lines are not exploitable: (void) mktemp(msgfac->mf_filename); if ((msgfac->mf_fptr = fopen(msgfac->mf_filename, "w"))==NULL) except if someone could create the "mf_filename" file between the mktemp() call and the fopen() call.... hard... But i agree with the patch, the newer version is the good way to handle mktemp.
+1 for removal.
Thanks, fixed.
