Bug 475478 (CVE-2008-5380)
| Summary: | CVE-2008-5380 gpsdrive: Insecure temporary file use in geo-code, geo-nearest (symlink attack) | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Jan Lieskovsky <jlieskov> | ||||||||
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> | ||||||||
| Status: | CLOSED CURRENTRELEASE | QA Contact: | |||||||||
| Severity: | low | Docs Contact: | |||||||||
| Priority: | low | ||||||||||
| Version: | unspecified | CC: | kevin, vdanen | ||||||||
| Target Milestone: | --- | Keywords: | Security | ||||||||
| Target Release: | --- | ||||||||||
| Hardware: | All | ||||||||||
| OS: | Linux | ||||||||||
| URL: | http://lists.debian.org/debian-devel/2008/08/msg00285.html | ||||||||||
| Whiteboard: | |||||||||||
| Fixed In Version: | Doc Type: | Bug Fix | |||||||||
| Doc Text: | Story Points: | --- | |||||||||
| Clone Of: | Environment: | ||||||||||
| Last Closed: | 2009-08-27 18:05:07 UTC | Type: | --- | ||||||||
| Regression: | --- | Mount Type: | --- | ||||||||
| Documentation: | --- | CRM: | |||||||||
| Verified Versions: | Category: | --- | |||||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||||
| Embargoed: | |||||||||||
| Attachments: |
|
||||||||||
|
Description
Jan Lieskovsky
2008-12-09 13:06:59 UTC
This issue affects all versions of the gpsdrive package, as shipped with Fedora releases of 8, 9 and 10. Please update. What is the difference to CVE-2008-4959? IIRC, it only covered geo-code, so there may be some extra issues in geo-nearest, though all the samples provided seem to be dupes of what's already covered by CVE-2008-4959. See previous bug #470241. Created attachment 326897 [details]
patch for issue.
geo-nearest does have the same issues...
Here's a proposed patch for it.
I don't see anything else with the other script.
See my comment at: https://bugzilla.redhat.com/show_bug.cgi?id=470241#c6 There are some new issues reported in the Debian BTS: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=508597 (example is probably not a big deal and not easy to address via update) Created attachment 327066 [details]
patch for geo-nearest
Here's another patch for geo-nearest.
It seems to miss two tee output files, and may need something like:
--- geo-nearest.orig2 2008-12-16 14:46:14.000000000 +0100
+++ geo-nearest 2008-12-16 14:49:16.000000000 +0100
@@ -255,8 +255,8 @@
# Loop, getting at least "NUM" locations
#
if [ $DEBUG -gt 0 ]; then
- filter1="tee $TMP.page"
- filter2="tee $TMP.bulk"
+ filter1="tee $TMP/nearest_cache.page"
+ filter2="tee $TMP/waypoints.bulk"
else
filter1=cat
filter2=cat
On the other hand, remove_cruft will delete that at the end anyway, so not far away from setting filterX to cat unconditionally.
Created attachment 327196 [details]
new patch for geo-nearest
Good catch. Revised patch attached.
Looks better. (In reply to comment #4) > There are some new issues reported in the Debian BTS: > http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=508597 This is on a way to get new CVE id: http://www.openwall.com/lists/oss-security/2008/12/17/15 Upstream bug related to all these temp file issues: http://sourceforge.net/tracker/index.php?func=detail&aid=2121124&group_id=148048&atid=770280 Kevin, will you add our patches there? (In reply to comment #8) > Kevin, will you add our patches there? I commented in Debian BTS: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=508595#20 and in SF.net tracker. Affected scripts were dropped upstream: http://gpsdrive.svn.sourceforge.net/viewvc/gpsdrive?view=rev&revision=220 Ooops, copy-n-paste-o, link above should be: http://gpsdrive.svn.sourceforge.net/viewvc/gpsdrive?view=rev&revision=2204 (commit that drops geo-code, geo-nearest and gpssmswatch) gpsdrive-2.09-7.fc10 has been pushed to the Fedora 10 stable repository. If problems still persist, please make note of it in this bug report. gpsdrive-2.09-7.fc9 has been pushed to the Fedora 9 stable repository. If problems still persist, please make note of it in this bug report. This was fixed ages ago. |