Bug 199432

Summary:	nant: arbitrary command execution due to buildroot remainders
Product:	[Fedora] Fedora	Reporter:	Ville Skyttä <scop>
Component:	nant	Assignee:	Paul F. Johnson <paul>
Status:	CLOSED CURRENTRELEASE	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	high	Docs Contact:
Priority:	high
Version:	rawhide	CC:	extras-qa, fedora-security-list
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	0.85-6	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2006-07-20 12:26:42 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Ville Skyttä 2006-07-19 15:40:26 UTC

See bug 193957 comment 17 (and a potential fix in comment 16 there):

/usr/bin/nant from nant-0.85-5.fc6 tries to execute NAnt.exe from a path
containing the build root, ie. /var/tmp/... which is world writable, resulting
in arbitrary command execution vulnerability.

Comment 1 Paul F. Johnson 2006-07-20 12:26:42 UTC

This has been fixed in 0.85-6