Bug#754041: "apt-get build-dep <pkgname>" no longer secure when cwd=/tmp
Package: apt
Version: 1.1~exp1
Severity: minor
Tags: security
First of all, thanks for bringing new exciting features to apt!
I'm afraid, however, that one of these features, namely
* add support for "apt-get build-dep unpacked-source-dir"
brought an unanticipated security regression.
Consider the following command:
# apt-get build-dep nyancat
It used to be safe to execute it regardless of what your working
directory was. But in apt_1.1~exp1, this is no longer secure if cwd is a
world-writable, for example /tmp. A local malicious user could create
crafted /tmp/nyancat/debian/control, tricking apt into installing
packages of their choice. Or they could symlink
/tmp/nyancat/debian/control to /dev/urandom...
-- System Information:
Debian Release: jessie/sid
APT prefers unstable
APT policy: (990, 'unstable'), (500, 'experimental')
Architecture: i386 (x86_64)
Foreign Architectures: amd64
Kernel: Linux 3.14-1-amd64 (SMP w/2 CPU cores)
Locale: LANG=C, LC_CTYPE=pl_PL.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Versions of packages apt depends on:
ii debian-archive-keyring 2012.4
ii gnupg 1.4.18-1
ii libapt-pkg4.13 1.1~exp1
ii libc6 2.19-4
ii libgcc1 1:4.9.0-10
ii libstdc++6 4.9.0-10
--
Jakub Wilk
Reply to: