babiloo: insecure downloading and unpacking of dictionary files

Debian Bug report logs - #591995
babiloo: insecure downloading and unpacking of dictionary files

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Jakub Wilk <jwilk@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: babiloo: insecure downloading and unpacking of dictionary files

Date: Fri, 6 Aug 2010 21:49:46 +0200

[Message part 1 (text/plain, inline)]

Package: babiloo
Version: 2.0.9-1
Severity: grave
Tags: security
Justification: user security hole

babiloo creates temporary files with predictable names, allowing a local 
attacker to overwrite arbitrary files.

An example scenario:

1. Attacker does `ln -sf /file/to/overwrite /tmp/fra_vie.dct.zip`.
2. Victim runs babiloo, selects Dictionaries > Download
Dictionaries, selects the "French-Vietnamese" dictionary, and clicks
the icon to download it.

In addition to that, babiloo appears to be affected by CVE-2007-4559.

-- 
Jakub Wilk

[signature.asc (application/pgp-signature, inline)]

Message #10 received at 591995@bugs.debian.org (full text, mbox, reply):

From: Marco Rodrigues <gothicx@gmail.com>

To: 591995@bugs.debian.org

Cc: jwilk@debian.org

Subject: About babiloo security bug

Date: Sat, 4 Sep 2010 23:39:17 +0100

Hi Jakub!

I would try to fix it ASAP.

Thank you

-- 
Marco Rodrigues

http://www.marblehole.com

Message #21 received at 591995-close@bugs.debian.org (full text, mbox, reply):

From: Marco Rodrigues <gothicx@gmail.com>

To: 591995-close@bugs.debian.org

Subject: Bug#591995: fixed in babiloo 2.0.11-1

Date: Wed, 29 Sep 2010 22:02:05 +0000

Source: babiloo
Source-Version: 2.0.11-1

We believe that the bug you reported is fixed in the latest version of
babiloo, which is due to be installed in the Debian FTP archive:

babiloo_2.0.11-1.diff.gz
  to main/b/babiloo/babiloo_2.0.11-1.diff.gz
babiloo_2.0.11-1.dsc
  to main/b/babiloo/babiloo_2.0.11-1.dsc
babiloo_2.0.11-1_all.deb
  to main/b/babiloo/babiloo_2.0.11-1_all.deb
babiloo_2.0.11.orig.tar.gz
  to main/b/babiloo/babiloo_2.0.11.orig.tar.gz



A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 591995@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Marco Rodrigues <gothicx@gmail.com> (supplier of updated babiloo package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.8
Date: Tue, 28 Sep 2010 22:30:41 +0100
Source: babiloo
Binary: babiloo
Architecture: source all
Version: 2.0.11-1
Distribution: unstable
Urgency: low
Maintainer: Python Applications Packaging Team <python-apps-team@lists.alioth.debian.org>
Changed-By: Marco Rodrigues <gothicx@gmail.com>
Description: 
 babiloo    - dictionary viewer with multi-languages support
Closes: 591995
Changes: 
 babiloo (2.0.11-1) unstable; urgency=low
 .
   * New upstream version (Closes: #591995).
   * debian/control:
     + Move python-qt4 to Recommends. Thanks Jakub Wilk for the tip.
     + Change my e-mail address.
   * debian/copyright:
     + Change my e-mail address.
   * debian/control:
     - Bump Standards-Version to 3.9.1, no changes required.
Checksums-Sha1: 
 52c7a1176b1dd4050e30691df809946a23304c1a 1334 babiloo_2.0.11-1.dsc
 bee082229588bfc2b7c55ae3c8e173f6ca10a789 949765 babiloo_2.0.11.orig.tar.gz
 5e5197212e75b2644e82f368c64e586866a26d9c 2946 babiloo_2.0.11-1.diff.gz
 b33344c2cff18c05f9f2943204626099734f3e87 895280 babiloo_2.0.11-1_all.deb
Checksums-Sha256: 
 2e673076315992b1ca8d697ae001726b27a2c823436bf1eba3f8da9708ec7c38 1334 babiloo_2.0.11-1.dsc
 2b7fa4b0336c1664b87f9018cd8dbd0fe20edf25f4c57eb17e41c1095199611b 949765 babiloo_2.0.11.orig.tar.gz
 bca1aef85eb9fc0836c65994bcacf0d1e4e76d5b1c15ba83ae40d372dd0a2798 2946 babiloo_2.0.11-1.diff.gz
 f0e93409c9dbbb136ff85e00d4a3b6b84d9aaedd21311fbbfd31c4b2bbe72aa5 895280 babiloo_2.0.11-1_all.deb
Files: 
 cb3c2489e413658b357ba93bcc111291 1334 utils optional babiloo_2.0.11-1.dsc
 c384c6874590517515a20d8530b85ab1 949765 utils optional babiloo_2.0.11.orig.tar.gz
 19456945e7291be2e119583c605446a4 2946 utils optional babiloo_2.0.11-1.diff.gz
 08328cdab08ddce4a1eb49bee175ff37 895280 utils optional babiloo_2.0.11-1_all.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iEYEARECAAYFAkyjs98ACgkQB01zfu119ZnC6ACfQPOLCo8EZgakA8LcbjTvilom
9h0An3upBm2X9Q2/IfNd58xvAiSTIYOl
=pJ5A
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.