buggnats - Bugs: bug #25577, Unsafe mktemp usage in send-pr.

 
 

bug #25577: Unsafe mktemp usage in send-pr.

Submitter:  None
Submitted:  Fri 13 Feb 2009 11:24:05 AM UTC
   
 
Category:  None Severity:  3 - Normal
Item Group:  None Status:  Fixed
Privacy:  Public Assigned to:  amanou
Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Fri 13 Mar 2015 10:02:35 PM UTC, comment #2: 

This was fixed by gnats/send-pr.sh revision 1.9 and the fix is included in the gnats 4.2.0 release. This is the relevant NEWS entry of the release announcement:
- FreeBSD-SA-05:20.cvsbug security advisory (affected send-pr)

Alex Manoussakis <amanou>
Group administrator
Fri 13 Feb 2009 12:20:18 PM UTC, comment #1: 

Oops, looked at a deleted file. Same report applies to gnats/gnats/send-pr.sh though:

http://cvs.savannah.gnu.org/viewvc/gnats/gnats/gnats/send-pr.sh?revision=1.5&view=markup

--
Malte Dehling
email: mdehling at some site called uni-math.gwdg.de

Anonymous
Fri 13 Feb 2009 11:24:05 AM UTC, original submission:  

Temp-file is deleted but still used afterwords. A symlink could be created to overwrite some other file of the invoking user. The rm -f line is not needed at all i think.

(latest CVS version. rev. 1.26 branch MAIN. gnats/gnats/send-pr/send-pr.sh)

diff -uNi send-pr.sh.orig send-pr.sh
--- send-pr.sh.orig     2009-02-13 12:14:58.000000000 +0100
+++ send-pr.sh  2009-02-13 12:18:40.000000000 +0100
@@ -158,7 +158,6 @@
   else
     DEFAULT_ORIGINATOR="$FROM (`cat $TEMP`)"
   fi
-  rm -f $TEMP
 fi
 
 if [ -z "$ORGANIZATION" ]

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by amanou (Posted a comment)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 3 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2015-03-13 amanou StatusNone Fixed
        Assigned toNone amanou
        Open/ClosedOpen Closed

    Back to the top

    Powered by Savane 3.13-d3ae.
    Corresponding source code