Multiple symlink vulnerabilities

Debian Bug report logs - #445308
Multiple symlink vulnerabilities

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Romain Francoise <rfrancoise@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: Multiple symlink vulnerabilities

Date: Thu, 04 Oct 2007 21:16:43 +0200

Package: guilt
Version: 0.27-1
Severity: critical
Tags: security

guilt makes extensive use of the '$$' shell variable for temporary
files in /tmp.  This is a serious security vulnerability; on multi-user
systems it allows an attacker to clobber files with something like the 
following:

  for i in `seq 1 32768`; do 
    ln -sf /etc/passwd /tmp/guilt.log.$i;
  done

(In this example, if root does e.g. 'guilt push', /etc/passwd will get
clobbered.)

Please use mktemp(1) to create temporary files.

For reference:

guilt-0.27$ grep '$$' *
guilt:                          $reject "$p" > /dev/null 2> /tmp/guilt.log.$$
guilt:                                  rm -f /tmp/guilt.log.$$ /tmp/guilt.msg.\
$$
guilt:          do_get_header "$p" > /tmp/guilt.msg.$$
guilt:          [ ! -s /tmp/guilt.msg.$$ ] && echo "patch $pname" > /tmp/guilt.\
msg.$$
guilt:  rm -f /tmp/guilt.msg.$$ /tmp/guilt.log.$$
guilt:          do_get_full_header "$p" > /tmp/guilt.diff.$$
guilt:                  ) >> /tmp/guilt.diff.$$
guilt:          git-diff $diffopts "$2" >> /tmp/guilt.diff.$$
guilt-header:   do_get_full_header "$GUILT_DIR/$branch/$patch" > /tmp/guilt.msg\
.$$
guilt-header:   do_get_patch "$GUILT_DIR/$branch/$patch" > /tmp/guilt.diff.$$
guilt-header:           cat /tmp/guilt.msg.$$
guilt-header:           cat /tmp/guilt.diff.$$
guilt-0.27$

Thanks,

-- System Information:
Debian Release: lenny/sid
  APT prefers unstable
  APT policy: (500, 'unstable')
Architecture: amd64 (x86_64)

Kernel: Linux 2.6.22-2-amd64 (SMP w/2 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/bash

Versions of packages guilt depends on:
ii  git-core                     1:1.5.3.3-1 fast, scalable, distributed revisi

guilt recommends no packages.

-- no debconf information

Message #12 received at 445308@bugs.debian.org (full text, mbox, reply):

From: Brandon Philips <brandon@ifup.org>

To: Romain Francoise <rfrancoise@debian.org>, 445308@bugs.debian.org

Subject: Re: Bug#445308: Multiple symlink vulnerabilities

Date: Thu, 4 Oct 2007 13:17:12 -0700

On 21:16 Thu 04 Oct 2007, Romain Francoise wrote:
> Please use mktemp(1) to create temporary files.

I have contacted Josef Sipek, the author, about the issue and he will
work on it for the next release.

I will close this bug when the next release hits Debian.

Thanks,

	Brandon

Message #17 received at 445308@bugs.debian.org (full text, mbox, reply):

From: Nico Golde <nion@debian.org>

To: Brandon Philips <brandon@ifup.org>, 445308@bugs.debian.org

Cc: Romain Francoise <rfrancoise@debian.org>

Subject: Re: Bug#445308: Multiple symlink vulnerabilities

Date: Thu, 4 Oct 2007 22:31:52 +0200

[Message part 1 (text/plain, inline)]

Hi,
* Brandon Philips <brandon@ifup.org> [2007-10-04 22:27]:
> On 21:16 Thu 04 Oct 2007, Romain Francoise wrote:
> > Please use mktemp(1) to create temporary files.
> 
> I have contacted Josef Sipek, the author, about the issue and he will
> work on it for the next release.
> 
> I will close this bug when the next release hits Debian.

JFYI, requested CVE id for this.
Kind regards
Nico
-- 
Nico Golde - http://ngolde.de - nion@jabber.ccc.de - GPG: 0x73647CFF
For security reasons, all text in this mail is double-rot13 encrypted.

[Message part 2 (application/pgp-signature, inline)]

Message #24 received at 445308@bugs.debian.org (full text, mbox, reply):

From: Nico Golde <nion@debian.org>

To: Brandon Philips <brandon@ifup.org>, 445308@bugs.debian.org

Cc: Romain Francoise <rfrancoise@debian.org>

Subject: Re: Bug#445308: Multiple symlink vulnerabilities

Date: Thu, 4 Oct 2007 23:16:37 +0200

[Message part 1 (text/plain, inline)]

Hi again,
* Nico Golde <nion@debian.org> [2007-10-04 22:47]:
> * Brandon Philips <brandon@ifup.org> [2007-10-04 22:27]:
> > On 21:16 Thu 04 Oct 2007, Romain Francoise wrote:
> > > Please use mktemp(1) to create temporary files.
> > 
> > I have contacted Josef Sipek, the author, about the issue and he will
> > work on it for the next release.
> > 
> > I will close this bug when the next release hits Debian.
> 
> JFYI, requested CVE id for this.

It got CVE-2007-5207
The information is not yet available on the cve.mitre site 
but should be soon. Please include the CVE id in the 
changelog if you close this bug.

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5207
Kind regards
NIco
-- 
Nico Golde - http://ngolde.de - nion@jabber.ccc.de - GPG: 0x73647CFF
For security reasons, all text in this mail is double-rot13 encrypted.

[Message part 2 (application/pgp-signature, inline)]

Message #29 received at 445308@bugs.debian.org (full text, mbox, reply):

From: Nico Golde <nion@debian.org>

To: 445308@bugs.debian.org

Subject: Re: Bug#445308: Multiple symlink vulnerabilities

Date: Sat, 6 Oct 2007 12:56:20 +0200

[Message part 1 (text/plain, inline)]

Hi,
I intend to NMU this bug.
The attached patch fixes this issue.
It will be also archived on:
http://people.debian.org/~nion/nmu-diff/guilt_0.27-1_0.27-1.1.patch

Kind regards
Nico
-- 
Nico Golde - http://ngolde.de - nion@jabber.ccc.de - GPG: 0x73647CFF
For security reasons, all text in this mail is double-rot13 encrypted.

[guilt.patch (text/x-diff, attachment)]

[Message part 3 (application/pgp-signature, inline)]

Message #36 received at 445308@bugs.debian.org (full text, mbox, reply):

From: Nico Golde <nion@debian.org>

To: 445308@bugs.debian.org

Subject: Re: Multiple symlink vulnerabilities

Date: Sat, 6 Oct 2007 17:36:14 +0200

[Message part 1 (text/plain, inline)]

Hi,
uploading a fix now with permission of the maintainer.
Kind regards
Nico

-- 
Nico Golde - http://ngolde.de - nion@jabber.ccc.de - GPG: 0x73647CFF
For security reasons, all text in this mail is double-rot13 encrypted.

[Message part 2 (application/pgp-signature, inline)]

Message #41 received at 445308@bugs.debian.org (full text, mbox, reply):

From: Josef Sipek <jsipek@fsl.cs.sunysb.edu>

To: Nico Golde <nion@debian.org>, 445308@bugs.debian.org

Subject: Re: Bug#445308: Multiple symlink vulnerabilities

Date: Sat, 6 Oct 2007 11:47:56 -0400

On Sat, Oct 06, 2007 at 12:56:20PM +0200, Nico Golde wrote:
> Hi,
> I intend to NMU this bug.
> The attached patch fixes this issue.
> It will be also archived on:
> http://people.debian.org/~nion/nmu-diff/guilt_0.27-1_0.27-1.1.patch
 
This patch breaks Guilt in several ways, I am in the process of fixing it
right now, and I'll push the commit out when I am done. Brandon can then
decide whether he wants to pick up the one patch and backport it on top of
0.27 or just do a 0.28-snapshot type package.

Josef 'Jeff' Sipek.

-- 
Keyboard not found!
Press F1 to enter Setup

Message #46 received at 445308-close@bugs.debian.org (full text, mbox, reply):

From: Nico Golde <nion@debian.org>

To: 445308-close@bugs.debian.org

Subject: Bug#445308: fixed in guilt 0.27-1.1

Date: Sat, 06 Oct 2007 15:47:02 +0000

Source: guilt
Source-Version: 0.27-1.1

We believe that the bug you reported is fixed in the latest version of
guilt, which is due to be installed in the Debian FTP archive:

guilt_0.27-1.1.diff.gz
  to pool/main/g/guilt/guilt_0.27-1.1.diff.gz
guilt_0.27-1.1.dsc
  to pool/main/g/guilt/guilt_0.27-1.1.dsc
guilt_0.27-1.1_all.deb
  to pool/main/g/guilt/guilt_0.27-1.1_all.deb



A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 445308@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Nico Golde <nion@debian.org> (supplier of updated guilt package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.7
Date: Sat, 06 Oct 2007 12:47:08 +0200
Source: guilt
Binary: guilt
Architecture: source all
Version: 0.27-1.1
Distribution: unstable
Urgency: high
Maintainer: Brandon Philips <brandon@ifup.org>
Changed-By: Nico Golde <nion@debian.org>
Description: 
 guilt      - quilt for git; similar to Mercurial queues
Closes: 445308
Changes: 
 guilt (0.27-1.1) unstable; urgency=high
 .
   * Non-maintainer upload by testing security team.
   * Included CVE-2007-5207.patch to fix insecure handling
     of temporary files (CVE-2007-5207) (Closes: #445308).
Files: 
 3b604a6fe58b49f6d12eaa0493f58087 602 devel optional guilt_0.27-1.1.dsc
 2e4ee15f25e00a62ef949938abad090f 3768 devel optional guilt_0.27-1.1.diff.gz
 7f5da465c852866124c476292c852a20 38976 devel optional guilt_0.27-1.1_all.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFHB6r7HYflSXNkfP8RAulXAJ9T0DOIoHkonP2lz/Gp6LKw8GLCfACbB3nN
Nr6bhZDCgJBxuxjnsN40wzo=
=7BSV
-----END PGP SIGNATURE-----

Message #51 received at 445308@bugs.debian.org (full text, mbox, reply):

From: Brandon Philips <brandon@ifup.org>

To: Josef Sipek <jsipek@fsl.cs.sunysb.edu>, 445308@bugs.debian.org

Cc: Nico Golde <nion@debian.org>

Subject: Re: Bug#445308: Multiple symlink vulnerabilities

Date: Sat, 6 Oct 2007 09:13:06 -0700

On 11:47 Sat 06 Oct 2007, Josef Sipek wrote:
> On Sat, Oct 06, 2007 at 12:56:20PM +0200, Nico Golde wrote:
> > Hi,
> > I intend to NMU this bug.
> > The attached patch fixes this issue.
> > It will be also archived on:
> > http://people.debian.org/~nion/nmu-diff/guilt_0.27-1_0.27-1.1.patch
>  
> This patch breaks Guilt in several ways, I am in the process of fixing it
> right now, and I'll push the commit out when I am done. Brandon can then
> decide whether he wants to pick up the one patch and backport it on top of
> 0.27 or just do a 0.28-snapshot type package.

Well, crud.  Nico just did a NMU upload with that patch.

Nico- anyway to revoke the NMU?

	Brandon

Message #56 received at 445308@bugs.debian.org (full text, mbox, reply):

From: Josef Sipek <jsipek@fsl.cs.sunysb.edu>

To: Brandon Philips <brandon@ifup.org>

Cc: 445308@bugs.debian.org, Nico Golde <nion@debian.org>

Subject: Re: Bug#445308: Multiple symlink vulnerabilities

Date: Sat, 6 Oct 2007 12:25:56 -0400

On Sat, Oct 06, 2007 at 09:13:06AM -0700, Brandon Philips wrote:
> On 11:47 Sat 06 Oct 2007, Josef Sipek wrote:
> > On Sat, Oct 06, 2007 at 12:56:20PM +0200, Nico Golde wrote:
> > > Hi,
> > > I intend to NMU this bug.
> > > The attached patch fixes this issue.
> > > It will be also archived on:
> > > http://people.debian.org/~nion/nmu-diff/guilt_0.27-1_0.27-1.1.patch
> >  
> > This patch breaks Guilt in several ways, I am in the process of fixing it
> > right now, and I'll push the commit out when I am done. Brandon can then
> > decide whether he wants to pick up the one patch and backport it on top of
> > 0.27 or just do a 0.28-snapshot type package.
> 
> Well, crud.  Nico just did a NMU upload with that patch.
> 
> Nico- anyway to revoke the NMU?
> 
> 	Brandon

Committed fix:

http://git.kernel.org/?p=linux/kernel/git/jsipek/guilt.git;a=commitdiff_plain;h=a8e17e1a375f33e86bf1d4947a1f24741835f6c7;hp=b4c4c0adb86f2d9dbc97506f8b661dbff194ca1e

Josef 'Jeff' Sipek.

-- 
FORTUNE PROVIDES QUESTIONS FOR THE GREAT ANSWERS: #19
A:      To be or not to be.
Q:      What is the square root of 4b^2?

Message #61 received at 445308@bugs.debian.org (full text, mbox, reply):

From: Nico Golde <nion@debian.org>

To: Brandon Philips <brandon@ifup.org>, 445308@bugs.debian.org

Cc: Josef Sipek <jsipek@fsl.cs.sunysb.edu>

Subject: Re: Bug#445308: Multiple symlink vulnerabilities

Date: Sat, 6 Oct 2007 18:27:01 +0200

[Message part 1 (text/plain, inline)]

Hi,
* Brandon Philips <brandon@ifup.org> [2007-10-06 18:18]:
> On 11:47 Sat 06 Oct 2007, Josef Sipek wrote:
> > On Sat, Oct 06, 2007 at 12:56:20PM +0200, Nico Golde wrote:
> > > Hi,
> > > I intend to NMU this bug.
> > > The attached patch fixes this issue.
> > > It will be also archived on:
> > > http://people.debian.org/~nion/nmu-diff/guilt_0.27-1_0.27-1.1.patch
> >  
> > This patch breaks Guilt in several ways, I am in the process of fixing it
> > right now, and I'll push the commit out when I am done. Brandon can then
> > decide whether he wants to pick up the one patch and backport it on top of
> > 0.27 or just do a 0.28-snapshot type package.
> 
> Well, crud.  Nico just did a NMU upload with that patch.
> 
> Nico- anyway to revoke the NMU?

No apart from doing a new one. However it needs some time to 
get the package out of incoming so I can fix this with a new 
upload as soon as the patch is there.
Josef, what do I break exactly?
Sorry for breaking things anyway!
Kind regards
Nico
-- 
Nico Golde - http://ngolde.de - nion@jabber.ccc.de - GPG: 0x73647CFF
For security reasons, all text in this mail is double-rot13 encrypted.

[Message part 2 (application/pgp-signature, inline)]

Message #66 received at 445308@bugs.debian.org (full text, mbox, reply):

From: Josef Sipek <jsipek@fsl.cs.sunysb.edu>

To: Nico Golde <nion@debian.org>

Cc: Brandon Philips <brandon@ifup.org>, 445308@bugs.debian.org

Subject: Re: Bug#445308: Multiple symlink vulnerabilities

Date: Sat, 6 Oct 2007 12:33:58 -0400

On Sat, Oct 06, 2007 at 06:27:01PM +0200, Nico Golde wrote:
> Hi,
> * Brandon Philips <brandon@ifup.org> [2007-10-06 18:18]:
> > On 11:47 Sat 06 Oct 2007, Josef Sipek wrote:
> > > On Sat, Oct 06, 2007 at 12:56:20PM +0200, Nico Golde wrote:
> > > > Hi,
> > > > I intend to NMU this bug.
> > > > The attached patch fixes this issue.
> > > > It will be also archived on:
> > > > http://people.debian.org/~nion/nmu-diff/guilt_0.27-1_0.27-1.1.patch
> > >  
> > > This patch breaks Guilt in several ways, I am in the process of fixing it
> > > right now, and I'll push the commit out when I am done. Brandon can then
> > > decide whether he wants to pick up the one patch and backport it on top of
> > > 0.27 or just do a 0.28-snapshot type package.
> > 
> > Well, crud.  Nico just did a NMU upload with that patch.
> > 
> > Nico- anyway to revoke the NMU?
> 
> No apart from doing a new one. However it needs some time to 
> get the package out of incoming so I can fix this with a new 
> upload as soon as the patch is there.
> Josef, what do I break exactly?

I applied it, and at least 3 commands didn't work; apparently you missed a
place or two where /tmp/guilt.XYZ.$$ was used, which cascaded into a bit of
the internal state getting clobbered (a guilt-referesh managed to do:
echo '' > .git/refs/heads/master) :)

> Sorry for breaking things anyway!

No problem :)

Josef 'Jeff' Sipek.

-- 
The obvious mathematical breakthrough would be development of an easy way to
factor large prime numbers.
		- Bill Gates, The Road Ahead, pg. 265

Message #71 received at 445308@bugs.debian.org (full text, mbox, reply):

From: Nico Golde <nion@debian.org>

To: 445308@bugs.debian.org

Date: Sat, 6 Oct 2007 18:55:36 +0200

[Message part 1 (text/plain, inline)]

Hi,
attached is the new patch which has just been uploaded.
Thanks for your help in this issue!
Nico

-- 
Nico Golde - http://ngolde.de - nion@jabber.ccc.de - GPG: 0x73647CFF
For security reasons, all text in this mail is double-rot13 encrypted.

[guilt_0.27-1_0.27-1.2.patch (text/x-diff, attachment)]

[Message part 3 (application/pgp-signature, inline)]

Message #76 received at 445308-close@bugs.debian.org (full text, mbox, reply):

From: Nico Golde <nion@debian.org>

To: 445308-close@bugs.debian.org

Subject: Bug#445308: fixed in guilt 0.27-1.2

Date: Sat, 06 Oct 2007 17:02:03 +0000

Source: guilt
Source-Version: 0.27-1.2

We believe that the bug you reported is fixed in the latest version of
guilt, which is due to be installed in the Debian FTP archive:

guilt_0.27-1.2.diff.gz
  to pool/main/g/guilt/guilt_0.27-1.2.diff.gz
guilt_0.27-1.2.dsc
  to pool/main/g/guilt/guilt_0.27-1.2.dsc
guilt_0.27-1.2_all.deb
  to pool/main/g/guilt/guilt_0.27-1.2_all.deb



A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 445308@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Nico Golde <nion@debian.org> (supplier of updated guilt package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.7
Date: Sat, 06 Oct 2007 18:31:30 +0200
Source: guilt
Binary: guilt
Architecture: source all
Version: 0.27-1.2
Distribution: unstable
Urgency: high
Maintainer: Brandon Philips <brandon@ifup.org>
Changed-By: Nico Golde <nion@debian.org>
Description: 
 guilt      - quilt for git; similar to Mercurial queues
Closes: 445308
Changes: 
 guilt (0.27-1.2) unstable; urgency=high
 .
   * Non-maintainer upload by testing security team
   * Updated patch to fix insecure file handling
     (CVE-2007-5207) provided by upstream author since the last
     patch introduces some problems (Closes: #445308).
Files: 
 c65f4fe466300ce55f44de9ff57a90f3 602 devel optional guilt_0.27-1.2.dsc
 44ef0f98a6fc8489b11797ba1728d70c 4353 devel optional guilt_0.27-1.2.diff.gz
 99ed23b678ffd27b2df7046e60672a1e 39124 devel optional guilt_0.27-1.2_all.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFHB73cHYflSXNkfP8RAu8yAJ9E+Z5aVS29dGNkcVM9+OAKAfqKogCghca1
c34gJbGabXpept/N59/JtkY=
=eLpb
-----END PGP SIGNATURE-----

Message #85 received at 445308-done@bugs.debian.org (full text, mbox, reply):

From: Thijs Kinkhorst <thijs@debian.org>

To: 445308-done@bugs.debian.org

Subject: fixed in upstream version

Date: Wed, 13 Aug 2008 11:40:44 +0200

[Message part 1 (text/plain, inline)]

Version: 0.28-1

This bug has been fixed by Nico in an NMU, but that NMU was not acknowledged. 
However, upstream has fixed the issue in their upstream version 0.28, so I'm 
closing the bug.


Thijs

[Message part 2 (application/pgp-signature, inline)]

Send a report that this bug log contains spam.