Bug#294832: marked as done (FWD: insecure temporary file creation in kdelibs 3.3.2)
Your message dated Sun, 13 Feb 2005 09:17:29 -0500
with message-id <E1D0KYz-0008RC-00@newraff.debian.org>
and subject line Bug#294832: fixed in kdelibs 4:3.3.2-2
has caused the attached Bug report to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what I am
talking about this indicates a serious mail system misconfiguration
somewhere. Please contact me immediately.)
Debian bug tracking system administrator
(administrator, Debian Bugs database)
--------------------------------------
Received: (at submit) by bugs.debian.org; 11 Feb 2005 20:33:58 +0000
>From joey@kitenet.net Fri Feb 11 12:33:57 2005
Return-path: <joey@kitenet.net>
Received: from kitenet.net [64.62.161.42] (postfix)
by spohr.debian.org with esmtp (Exim 3.35 1 (Debian))
id 1CzhUD-0001Kd-00; Fri, 11 Feb 2005 12:33:57 -0800
Received: from dragon.kitenet.net (unknown [66.168.94.144])
(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
(Client CN "Joey Hess", Issuer "Joey Hess" (verified OK))
by kitenet.net (Postfix) with ESMTP id 32F2D1800A
for <submit@bugs.debian.org>; Fri, 11 Feb 2005 20:33:57 +0000 (GMT)
Received: by dragon.kitenet.net (Postfix, from userid 1000)
id 99EF66E20E; Fri, 11 Feb 2005 15:36:10 -0500 (EST)
Date: Fri, 11 Feb 2005 15:36:10 -0500
From: Joey Hess <joeyh@debian.org>
To: submit@bugs.debian.org
Subject: FWD: insecure temporary file creation in kdelibs 3.3.2
Message-ID: <[🔎] 20050211203610.GB27457@kitenet.net>
Mime-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha1;
protocol="application/pgp-signature"; boundary="aVD9QWMuhilNxW9f"
Content-Disposition: inline
User-Agent: Mutt/1.5.6+20040907i
Delivered-To: submit@bugs.debian.org
X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2005_01_02
(1.212-2003-09-23-exp) on spohr.debian.org
X-Spam-Status: No, hits=-8.0 required=4.0 tests=BAYES_00,HAS_PACKAGE
autolearn=no version=2.60-bugs.debian.org_2005_01_02
X-Spam-Level:
--aVD9QWMuhilNxW9f
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
Package: kdelibs-data
Version: 4:3.3.2-1
Tags: security
Severity: grave
We're vulnerable.
----- Forwarded message from Davide Madrisan <davide.madrisan@qilinux.it> -=
----
=46rom: Davide Madrisan <davide.madrisan@qilinux.it>
Date: Fri, 11 Feb 2005 09:16:38 +0100
To: bugtraq@securityfocus.com
Subject: insecure temporary file creation in kdelibs 3.3.2
Organization: QiNet s.r.l.
User-Agent: KMail/1.7.2
The `dcopidlng' script in the KDE library package=20
(kdelibs-3.3.2/dcop/dcopidlng/dcopidlng)
creates temporary files in a unsecure manner.
This bug has been fixed in 32 minutes (!) by Stephan Kulow, the KDE team=20
leader. Here you can found the official patch:
http://bugs.kde.org/show_bug.cgi?id=3D97608
Note: This bug has been find by `autospec', the work-in-progress tool used =
by=20
the QiLinux team to (semi)automatically create specfiles from tarballs and=
=20
update/check rpm packages. It's released under GPL and not QiLinux specific.
The latest release can be found at the URL:
ftp://ftp.qilinux.it/pub/QiLinux/devel/tools/autospec/
#include <best/regards.h>
---
Davide Madrisan
QiLinux Security Team Leader
PGP keyID: 4B72B0B9 fp: 2B79 BFF1 EE33 EE8C 3258 E43C CDA8 EFF3 4B72 B0B9
PGP public key: <http://pgp.mit.edu/>
http://www.qilinux.it
----- End forwarded message -----
--=20
see shy jo
--aVD9QWMuhilNxW9f
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature
Content-Disposition: inline
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.0 (GNU/Linux)
iD8DBQFCDRc5d8HHehbQuO8RAjvQAJwMRgsyz9feGBGEFgayLLhWreUUnACfRFSO
8rTvkkXEFtEc3Jka+cc08E0=
=jwdZ
-----END PGP SIGNATURE-----
--aVD9QWMuhilNxW9f--
---------------------------------------
Received: (at 294832-close) by bugs.debian.org; 13 Feb 2005 14:23:02 +0000
>From katie@ftp-master.debian.org Sun Feb 13 06:23:02 2005
Return-path: <katie@ftp-master.debian.org>
Received: from newraff.debian.org [208.185.25.31] (mail)
by spohr.debian.org with esmtp (Exim 3.35 1 (Debian))
id 1D0KeM-0004AT-00; Sun, 13 Feb 2005 06:23:02 -0800
Received: from katie by newraff.debian.org with local (Exim 3.35 1 (Debian))
id 1D0KYz-0008RC-00; Sun, 13 Feb 2005 09:17:29 -0500
From: Debian Qt/KDE Maintainers <debian-qt-kde@lists.debian.org>
To: 294832-close@bugs.debian.org
X-Katie: $Revision: 1.55 $
Subject: Bug#294832: fixed in kdelibs 4:3.3.2-2
Message-Id: <E1D0KYz-0008RC-00@newraff.debian.org>
Sender: Archive Administrator <katie@ftp-master.debian.org>
Date: Sun, 13 Feb 2005 09:17:29 -0500
Delivered-To: 294832-close@bugs.debian.org
X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2005_01_02
(1.212-2003-09-23-exp) on spohr.debian.org
X-Spam-Status: No, hits=-6.0 required=4.0 tests=BAYES_00,HAS_BUG_NUMBER
autolearn=no version=2.60-bugs.debian.org_2005_01_02
X-Spam-Level:
X-CrossAssassin-Score: 6
Source: kdelibs
Source-Version: 4:3.3.2-2
We believe that the bug you reported is fixed in the latest version of
kdelibs, which is due to be installed in the Debian FTP archive:
kdelibs-bin_3.3.2-2_i386.deb
to pool/main/k/kdelibs/kdelibs-bin_3.3.2-2_i386.deb
kdelibs-data_3.3.2-2_all.deb
to pool/main/k/kdelibs/kdelibs-data_3.3.2-2_all.deb
kdelibs4-dev_3.3.2-2_i386.deb
to pool/main/k/kdelibs/kdelibs4-dev_3.3.2-2_i386.deb
kdelibs4-doc_3.3.2-2_all.deb
to pool/main/k/kdelibs/kdelibs4-doc_3.3.2-2_all.deb
kdelibs4_3.3.2-2_i386.deb
to pool/main/k/kdelibs/kdelibs4_3.3.2-2_i386.deb
kdelibs_3.3.2-2.diff.gz
to pool/main/k/kdelibs/kdelibs_3.3.2-2.diff.gz
kdelibs_3.3.2-2.dsc
to pool/main/k/kdelibs/kdelibs_3.3.2-2.dsc
kdelibs_3.3.2-2_all.deb
to pool/main/k/kdelibs/kdelibs_3.3.2-2_all.deb
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to 294832@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Debian Qt/KDE Maintainers <debian-qt-kde@lists.debian.org> (supplier of updated kdelibs package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.7
Date: Sun, 13 Feb 2005 04:58:29 +0100
Source: kdelibs
Binary: kdelibs4 kdelibs-bin kdelibs kdelibs4-doc kdelibs-data kdelibs4-dev
Architecture: source i386 all
Version: 4:3.3.2-2
Distribution: unstable
Urgency: high
Maintainer: Debian Qt/KDE Maintainers <debian-qt-kde@lists.debian.org>
Changed-By: Debian Qt/KDE Maintainers <debian-qt-kde@lists.debian.org>
Description:
kdelibs - KDE core libraries metapackage
kdelibs-bin - KDE core binaries
kdelibs-data - KDE core shared data
kdelibs4 - KDE core libraries
kdelibs4-dev - KDE core libraries (development files)
kdelibs4-doc - KDE core library documentation
Closes: 270592 290323 292081 292569 292765 294832 294896
Changes:
kdelibs (4:3.3.2-2) unstable; urgency=high
.
+++ Changes by Adeodato Simó:
.
* Include patch to fix CAN-2005-0365, "insecure temporary file creation in
kdelibs 3.3.2". dcopidlng no longer creates its temporary files in /tmp.
(Closes: #294832, #294896) Urgency set to high because of this and other
RC bug fixes below.
.
* KDE_3_3_BRANCH update.
.
* Include patch from CVS to fix XMLHttpRequest POST being broken in KHTML
due to a blank line in headers. (Closes: #292765)
.
+++ Changes by Christopher Martin:
.
* Add patch from upstream that solves the problem wherein programs whose
.desktop entry contained their full path, rather than just the binary
to be executed (mainly games), confused kdeinit.
(Closes: #270592, #290323)
.
* debian/control: Add necessary kdelibs-data Replaces for old
openoffice.org packages. (Closes: #292569)
.
* Add better manpage for lnusertemp. Thanks to Javier Fernández-Sanguino
Peña. (Closes: #292081)
Files:
97bcad06bc3f35a5966d652f31c304ee 1302 libs optional kdelibs_3.3.2-2.dsc
e8fc19fa7b6e05679c0a1685ee7c7ddd 441095 libs optional kdelibs_3.3.2-2.diff.gz
fe0f7edea20e8c0dcdc77a499f1b36bb 854500 libs optional kdelibs-bin_3.3.2-2_i386.deb
e48add20db2debc3583847ae41eac3e7 8186534 libs optional kdelibs4_3.3.2-2_i386.deb
80de26e8a8916a6db994488d55341377 1231148 libdevel optional kdelibs4-dev_3.3.2-2_i386.deb
5ed446dccab56f5f72bce0dbd106a551 18624 kde optional kdelibs_3.3.2-2_all.deb
f1dc691989bb771e344508defeb364b3 7083852 libs optional kdelibs-data_3.3.2-2_all.deb
3ea3e09f919dd12325316ea72b7b4372 11570094 doc optional kdelibs4-doc_3.3.2-2_all.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.0 (GNU/Linux)
Comment: Signed by Isaac Clerencia <isaac@warp.es>
iD8DBQFCD09IQET2GFTmct4RAujUAJ4jDMiVlyGQfPQDRTI1wI9Wiwox2QCePjH7
zeAG5hDal7zM91Z45OA0sgc=
=6tRo
-----END PGP SIGNATURE-----
Reply to: