Bug 169583

Summary:	CVE-2005-3011 texindex insecure temporary file usage
Product:	Red Hat Enterprise Linux 4	Reporter:	Josh Bressers <bressers>
Component:	texinfo	Assignee:	Miloslav Trmač <mitr>
Status:	CLOSED ERRATA	QA Contact:	Ben Levenson <benl>
Severity:	low	Docs Contact:
Priority:	medium
Version:	4.0	Keywords:	Security
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:	impact=low,source=cve,public=20000209,reported=20050921
Fixed In Version:	RHSA-2006-0727	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2006-11-08 10:02:06 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	170743, 170744, 176344

Description Josh Bressers 2005-09-29 20:59:31 UTC

The texindex command uses predictable temporary filenames.  This could allow a
rogue local user to create a symlink which would cause texindex to overwrite
various files the user running texindex has write access to.

There is more informatin in the Debian bug:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=328365

No patch exists yet.


This issue seems to be mitigated by the fact that texindex will only use a
temporary file when the file being processed is over 50,000 lines.

Comment 1 Josh Bressers 2005-09-29 21:00:24 UTC

This issue should also affect RHEL2.1 and RHEL3

Comment 3 Tim Waugh 2005-10-13 17:29:20 UTC

Hmm, not sure which patch to use.  The patch given here:

  http://patches.ubuntu.com/patches/texinfo.CAN-2005-3011.diff

seems to cause an error in my testing.  This short script:

>input.cp
for i in $(seq 1 50001)
do
  echo '\entry{foo}{1}{foo}' >>input.cp
done
texindex input.cp

produces:

/tmp/txidxHECDeb.3: File exists

Continuing investigation.

Comment 4 Tim Waugh 2005-10-13 18:13:57 UTC

Okay, Norbert Preining's texinfo-race-fix.diff is the one to use.

Comment 9 Mark J. Cox 2005-10-26 14:24:39 UTC

I'd like to defer this to a future ASYNC update rather than RHEL4U3.  If we do
this update for RHEL4U3 we also have to do an update for RHEL3U7 and an ASYNC
update for RHEL2.1.

Comment 13 RHEL Program Management 2006-08-18 17:17:39 UTC

This request was evaluated by Red Hat Product Management for inclusion in a Red
Hat Enterprise Linux maintenance release.  Product Management has requested
further review of this request by Red Hat Engineering, for potential
inclusion in a Red Hat Enterprise Linux Update release for currently deployed
products.  This request is not yet committed for inclusion in an Update
release.

Comment 18 Red Hat Bugzilla 2006-11-08 10:02:06 UTC

An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHSA-2006-0727.html