[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Possible mass bug filing: The possibility of attack with the help of symlinks in some Debian packages



report for etch:

http://uvw.ru/report.etch.txt

107 packages :(


On 18:23 Tue 12 Aug     , Dmitry E. Oboukhov wrote:

TDEO> The script in attach looks through a mirror of a specified distributive
TDEO> and makes a search of '>\s*/tmp/' and 'tee [^|]*/tmp/' constructions.

TDEO> It finds less errors then I've found earlier however the results of its
TDEO> work are more accurate.

TDEO> The script looks through all the files of packages marked as executable.
TDEO> That is even if the script is in /usr/share/doc and is marked as
TDEO> executable it will be tested nevertheless.

TDEO> The full viewing of a mirror takes a few hours.
TDEO> Later I shall publish the reports on lenny (already attached) and etch.
TDEO> :)

TDEO> attaches:
TDEO> report of lenny: http://uvw.ru/report.lenny.txt
TDEO> script: http://uvw.ru/find_the_bug2.sh

--
... mpd is off

. ''`. Dmitry E. Oboukhov
: :’  : unera@debian.org
`. `~’ GPGKey: 1024D / F8E26537 2006-11-21
  `- 1B23 D4F8 8EC0 D902 0555  E438 AB8C 00CF F8E2 6537

Attachment: signature.asc
Description: Digital signature


Reply to: