Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 297375 (CVE-2009-4135) - sys-apps/coreutils distcheck (dist-check.mk) symlink attack (CVE-2009-4135)
Summary: sys-apps/coreutils distcheck (dist-check.mk) symlink attack (CVE-2009-4135)
Status: RESOLVED INVALID
Alias: CVE-2009-4135
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: High minor (vote)
Assignee: Gentoo Security
URL: https://bugzilla.redhat.com/show_bug....
Whiteboard: B3 [stable?]
Keywords:
Depends on:
Blocks:
 
Reported: 2009-12-18 01:17 UTC by Stefan Behte (RETIRED)
Modified: 2009-12-18 16:48 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Stefan Behte (RETIRED) gentoo-dev Security 2009-12-18 01:17:12 UTC 
CVE-2009-4135 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-4135):
  The distcheck rule in dist-check.mk in GNU coreutils 5.2.1 through
  8.1 allows local users to gain privileges via a symlink attack on a
  file in a directory tree under /tmp.
Comment 1 Stefan Behte (RETIRED) gentoo-dev Security 2009-12-18 01:19:42 UTC 
base-system: what are your plans for stabilizaton of 8.2, what do you think about backporting?

Patch:
http://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=ae034822c535fa5
Comment 2 SpanKY gentoo-dev 2009-12-18 16:05:29 UTC 
why would any distro care about security issues in the distcheck rule ?  no one runs it, only the person upstream creating the release does.
Comment 3 Stefan Behte (RETIRED) gentoo-dev Security 2009-12-18 16:48:33 UTC 
I'm not into autobuild, so this didn't ring a bell and I thought base-system might use it. Thanks for the elaboration.