Bug#286379: Lintian insecure removal bug (#286379)

[Martin Schulze <joey@infodrom.org>]

Jeroen van Wolffelaar wrote:
> clone 286379 -1
> # why isn't there a BTS tag for 'disputed' or something??
> retitle 286379 [lib/Lab] Lintian lab created unsafely, disputed
> retitle -1 [CAN-2004-1000] [lib/Lab] Insecurely removes files after lab failed to be created
> tags -1 confirmed woody sarge sid
> severity -1 grave
> thanks
> 
> On Tue, Dec 21, 2004 at 05:39:29AM +0100, Martin Schulze wrote:
> > Ah.  Then I did not understand you inded.  I'd be glad for a fixed
> > package sent to the security team.
> 
> Ok, since you confirm this is a security issue, cloned and severity set
> to grave.
> 
> The originally reported issue is still under discussion, feel free to
> give your opinion there if you wish.

I haven't verified that this code is executed for each lintian execution.
However, if it is, then its an issue since the process does not fail if
mkdir fails, instead the directory is used.

Regards,

	Joey

-- 
The only stupid question is the unasked one.

Please always Cc to me when replying to me on the lists.