buggnats - Bugs: bug #25577, Unsafe mktemp usage in send-pr.


bug #25577: Unsafe mktemp usage in send-pr.

Submitted by:  None
Submitted on:  Fri 13 Feb 2009 11:24:05 AM UTC  
Category:  None Severity:  3 - Normal
Item Group:  None Status:  Fixed
Privacy:  Public Assigned to:  Alex Manoussakis <amanou>
Open/Closed:  Closed

Add a New Comment(Rich Markup)

You are not logged in

Please log in, so followups can be emailed to you.


Fri 13 Mar 2015 10:02:35 PM UTC, comment #2:

This was fixed by gnats/send-pr.sh revision 1.9 and the fix is included in the gnats 4.2.0 release. This is the relevant NEWS entry of the release announcement:
- FreeBSD-SA-05:20.cvsbug security advisory (affected send-pr)

Alex Manoussakis <amanou>
Project AdministratorIn charge of this item.
Fri 13 Feb 2009 12:20:18 PM UTC, comment #1:

Oops, looked at a deleted file. Same report applies to gnats/gnats/send-pr.sh though:


Malte Dehling
email: mdehling at some site called uni-math.gwdg.de

Fri 13 Feb 2009 11:24:05 AM UTC, original submission:

Temp-file is deleted but still used afterwords. A symlink could be created to overwrite some other file of the invoking user. The rm -f line is not needed at all i think.

(latest CVS version. rev. 1.26 branch MAIN. gnats/gnats/send-pr/send-pr.sh)

diff -uNi send-pr.sh.orig send-pr.sh
--- send-pr.sh.orig 2009-02-13 12:14:58.000000000 +0100
+++ send-pr.sh 2009-02-13 12:18:40.000000000 +0100
@@ -158,7 +158,6 @@
- rm -f $TEMP

if [ -z "$ORGANIZATION" ]



(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:

No files currently attached


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -email is unavailable- added by amanou (Posted a comment)

    Do you think this task is very important?
    If so, you can add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.




    Follow 3 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2015-03-13 amanou StatusNone => Fixed
        Assigned toNone => amanou
        Open/ClosedOpen => Closed

    Back to the top

    Powered by Savane 3.3