Bug#1050289: marked as done (Predicatble temporary directory and file names and insufficient error checking)
Your message dated Wed, 23 Aug 2023 09:06:40 +0000
with message-id <E1qYjp2-00HMQJ-A4@fasolo.debian.org>
and subject line Bug#1050289: fixed in sitesummary 0.1.55
has caused the Debian Bug report #1050289,
regarding Predicatble temporary directory and file names and insufficient error checking
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact owner@bugs.debian.org
immediately.)
--
1050289: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1050289
Debian Bug Tracking System
Contact owner@bugs.debian.org with problems
--- Begin Message ---
Package: sitesummary
Version: 0.1.54
sitesummary-client runs during boot and via cronjob with superuser privileges.
It creates both a directory with a predictable naming scheme: /tmp/sitesummary-<PID>.
Due to insufficient error checking a user can pre-create directories
which then will prevent its creation and prevent the script from changing the
current working directory before creating lots of temporary files. In case of
a cronjob the current working directory will be /root and during boot it will
be /. Thus during boot a tar file of the root directory will be created on /tmp
which may fill up the /tmp or root partition depending on disk size and
partition scheme.
Furthermore, the script will create the tar file following the same naming
scheme /tmp/sitesummary-<PID>.tar.gz which in the absence of kernel symlink
protection allows for symlink attacks.
--
Guido Berhoerster
--- End Message ---
--- Begin Message ---
Source: sitesummary
Source-Version: 0.1.55
Done: Mike Gabriel <sunweaver@debian.org>
We believe that the bug you reported is fixed in the latest version of
sitesummary, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to 1050289@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Mike Gabriel <sunweaver@debian.org> (supplier of updated sitesummary package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Format: 1.8
Date: Wed, 23 Aug 2023 10:43:16 +0200
Source: sitesummary
Architecture: source
Version: 0.1.55
Distribution: unstable
Urgency: medium
Maintainer: Debian Edu Developers <debian-edu@lists.debian.org>
Changed-By: Mike Gabriel <sunweaver@debian.org>
Closes: 1050289
Changes:
sitesummary (0.1.55) unstable; urgency=medium
.
[ Guido Berhoerster ]
* Fix insecure temporary file and directory creation, error checking.
Seurely create a temporary directory using mktemp and check for errors both
when creating the directory and wehn changing the current working directory.
Place the tarball inside the temporary directory instead of using a predictable
file name in /tmp which may lead to a symlink attack. Ensure the temporary
directory is always removed. (Closes: #1050289).
* Use quoting for fragments.
Checksums-Sha1:
f9a64c50a9b9572e8ee4ca69b6499800c5f3e201 1980 sitesummary_0.1.55.dsc
a3bf399a95be848445e19f0728dfe1fef22538d3 67608 sitesummary_0.1.55.tar.xz
bf2b1f999b2c3ea3fd7ab1663b588563058cd572 6705 sitesummary_0.1.55_source.buildinfo
Checksums-Sha256:
0758bf4d56b70944ed88fe299d494ded463ddfdac4f4b15bd19d8a1a2421eab3 1980 sitesummary_0.1.55.dsc
5a3fb8fdb5f3a90ef6cddf32f66068443eaa752dd1306a6a5e57ef5951cb8601 67608 sitesummary_0.1.55.tar.xz
82f517e715d357403d2e01a960bc0769dd5203154e035c0d45f2bcd3bd397e0e 6705 sitesummary_0.1.55_source.buildinfo
Files:
8808e309521a721e0373fc3acbc835d4 1980 misc optional sitesummary_0.1.55.dsc
847aaa54697502f08cb64e059af034ca 67608 misc optional sitesummary_0.1.55.tar.xz
17ae767d9735ca875e3cf19f9595b03c 6705 misc optional sitesummary_0.1.55_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQJJBAEBCAAzFiEEm/uu6GwKpf+/IgeCmvRrMCV3GzEFAmTlx6oVHHN1bndlYXZl
ckBkZWJpYW4ub3JnAAoJEJr0azAldxsxfDIP/iEbWPmAaXu6iR5W75sj6HS1iLyN
iN4DVfKqJwLEKnWJ9RLTlKRywclO3Xl/wt5gnUPSgkjWd+BLrE9A715XwwfK615B
QkuxmdhxA3J13rt5kc0X0XH8OaGHY3TOYFeTGavUzMI7wVML/Wgv8JodcdtPioLI
WkKMZPZ1abaXtdDX5wAVz5/dg5fDZZJj+/bBD6hsXXMUrrUj3G2Xl6cdHfe0ifhx
Cep/DqljTSmqUpctfyjqjYlXYcHNdqfvWTP7lc+Ww7U4twciFv/LfKA1Ke2RNYbS
TykItMKxJp6XkhXy3HcBaGdbAfOzLkvjK3dgzId/3e8ROy4ytk9u18laWZv9RSDx
Vj8VKC0mMWjomSrhLsaZ6Lr7EsqGocg4HFMjlC/+DH5/S18NgLwuz7KtDmnffkXR
OBcg7V1TJpdmlPkO1MeigceOLiIYsoPVCdtCSP+4yCaKHZaCPXxA624dSQFe9+8t
v6lc2lTPC6tjDab1bsJqE3iiiAl1vTcNPwxBayiWoe6Fi+mnuUCRSz3ZSvPU5Tpt
wlZr7MwlGZhuxOyWMENuIxYGzMKRuYIyt6IZMqBuRIFAqYqz7hb7PWvQclf1xmku
ys+fK1G3L3F+rdcs7JzLosqalN8Vam+vmYSncuZCaJeJ+Pf1oyOVxZU3e/jQen3q
/ZAPuO0BJZVbfqY7
=3XvD
-----END PGP SIGNATURE-----
--- End Message ---
Reply to: