Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 290631 (CVE-2009-1297) - <=sys-block/open-iscsi-2.0.870.3: Symlink attack (CVE-2009-1297)
Summary: <=sys-block/open-iscsi-2.0.870.3: Symlink attack (CVE-2009-1297)
Status: RESOLVED FIXED
Alias: CVE-2009-1297
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: High trivial (vote)
Assignee: Gentoo Security
URL:
Whiteboard: ~3 [noglsa]
Keywords:
Depends on:
Blocks:
 
Reported: 2009-10-26 20:40 UTC by Tobias Heinlein (RETIRED)
Modified: 2009-11-04 04:30 UTC (History)
3 users (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
CVE-2009-1297.patch (CVE-2009-1297.patch,798 bytes, patch)
2009-10-26 22:29 UTC, Stefan Behte (RETIRED) 		no flags Details | Diff
open-iscsi-2.0.870.3-r1.ebuild (open-iscsi-2.0.870.3-r1.ebuild,2.98 KB, text/plain)
2009-10-26 22:30 UTC, Stefan Behte (RETIRED) 		no flags Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Tobias Heinlein (RETIRED) gentoo-dev 2009-10-26 20:40:10 UTC 
CVE-2009-1297 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-1297):
  iscsi_discovery in open-iscsi in SUSE openSUSE 10.3 through 11.1 and
  SUSE Linux Enterprise (SLE) 10 SP2 and 11 allows local users to
  overwrite arbitrary files via a symlink attack on an unspecified
  temporary file that has a predictable name.
Comment 1 Tobias Heinlein (RETIRED) gentoo-dev 2009-10-26 20:43:04 UTC 
More information:
https://bugzilla.redhat.com/show_bug.cgi?id=523936
Patch used by Debian is linked in there.

Gentoo ships the iscsi_discovery script when the utils USE flag is enabled.

Maintainers, please prepare a fixed ebuild, thanks.
Comment 2 Tobias Heinlein (RETIRED) gentoo-dev 2009-10-26 20:48:57 UTC 
Oh, ~arch only, adjusting severity.
Comment 3 Stefan Behte (RETIRED) gentoo-dev Security 2009-10-26 22:29:31 UTC 
I've updated the ebuild for 2.0.871 in http://bugs.gentoo.org/show_bug.cgi?id=278589

As no one really maintains open-iscsi I'm currently proxy-maintaining it. I've changed several things in 2.0.871, and honestly really don't want to see 2.0.870.3 in portage anymore, I can't even build/test it on my workstation because the kernel is too new (that was an issue with the old ebuild).

The last bump & QA was done by Tobias, maybe he could bump again? ;)
Comment 4 Stefan Behte (RETIRED) gentoo-dev Security 2009-10-26 22:29:56 UTC 
Created attachment 208374 [details, diff]
CVE-2009-1297.patch
Comment 5 Stefan Behte (RETIRED) gentoo-dev Security 2009-10-26 22:30:20 UTC 
Created attachment 208375 [details]
open-iscsi-2.0.870.3-r1.ebuild
Comment 6 Stefan Behte (RETIRED) gentoo-dev Security 2009-10-26 22:39:27 UTC 
Sorry for bugspam! =)
Comment 7 Stefan Behte (RETIRED) gentoo-dev Security 2009-10-26 22:40:34 UTC 
Argh, again.
Comment 8 Tobias Scherbaum (RETIRED) gentoo-dev 2009-10-27 19:48:24 UTC 
(In reply to comment #3)
> The last bump & QA was done by Tobias, maybe he could bump again? ;)

Proxy commit in CVS. Get your quiz done plz ;) No stable version, closing this one therefore.