Bug 158993
Summary: | CAN-2005-1751 shtool insecure temporary file creation | ||
---|---|---|---|
Product: | Red Hat Enterprise Linux 2.1 | Reporter: | Josh Bressers <bressers> |
Component: | mm | Assignee: | Nalin Dahyabhai <nalin> |
Status: | CLOSED DEFERRED | QA Contact: | Brian Brock <bbrock> |
Severity: | low | Docs Contact: | |
Priority: | medium | ||
Version: | 2.1 | Keywords: | Security |
Target Milestone: | --- | ||
Target Release: | --- | ||
Hardware: | All | ||
OS: | Linux | ||
Whiteboard: | impact=low,public=20050524,source=vendor-sec,reported=20050526 | ||
Fixed In Version: | Doc Type: | Bug Fix | |
Doc Text: | Story Points: | --- | |
Clone Of: | Environment: | ||
Last Closed: | 2005-08-25 22:18:45 UTC | Type: | --- |
Regression: | --- | Mount Type: | --- |
Documentation: | --- | CRM: | |
Verified Versions: | Category: | --- | |
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
Cloudforms Team: | --- | Target Upstream Version: | |
Embargoed: |
Description
Josh Bressers
2005-05-27 15:17:53 UTC
shtool is used at build-time, and is not part of either the mm or mm-devel binary packages. Correct, this issue (while very remote I know) is only exploitable if mm is rebuilt from source. The advisory states that shtool is only vulnerable if it is used for the following operations: tarball, subst, scpp and path. I have not verified if mm uses these or not. During package build, the makefile calls shtool for these operations: version mkdir install If you attempt to make a new tarball, either with the "snap" or "dist" targets (we don't), then it's used for: fixperm version tarball So I don't think we have a problem here. Closure note: if we update to a newer version of mm, the problem goes away even for the make targets we don't call, so marking this WONTFIX. ... except I actually marked it DEFERRED. |