Bug#495756: ecl has rpath to insecure location (/tmp/buildd/ecl-0.9j-20080306/build/)

Subject: Bug#495756: ecl has rpath to insecure location (/tmp/buildd/ecl-0.9j-20080306/build/)
From: ballombe@debian.org (Bill Allombert)
Date: Wed, 20 Aug 2008 10:55:51 +0200
Message-id: <[🔎] 20080820085551.GA18296@yellowpig>

Package: ecl
Version: 0.9j-20080306-4
Severity: serious
Tags: security

Hello Debian Common Lisp Team,
ecl includes a ELF file /usr/lib/ecl/asdf.fas with a rpath pointing to
/tmp/buildd/ecl-0.9j-20080306/build/.

This allows an attacker with write access to that directory to
add modified libraries which will be loaded when someone
else run ecl.

Cheers,
-- 
Bill. <ballombe at debian.org>

Imagine a large red swirl here.

Reply to:

Follow-Ups:
- Bug#495756: ecl has rpath to insecure location (/tmp/buildd/ecl-0.9j-20080306/build/)
  - From: luca@pca.it (Luca Capello)

Prev by Date: Processed: [bts-link] source package clisp
Next by Date: cedilla 0.6+20080607-1 MIGRATED to testing
Previous by thread: Processed: [bts-link] source package clisp
Next by thread: Bug#495756: ecl has rpath to insecure location (/tmp/buildd/ecl-0.9j-20080306/build/)
Index(es):
- Date
- Thread