Bug 544284 (CVE-2009-4193)

Summary: CVE-2009-4193 Merkaartor: System files integrity break-out via symlink attack on log file
Product: [Other] Security Response Reporter: Jan Lieskovsky <jlieskov>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED CURRENTRELEASE QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: sven
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
URL: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=548546
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2009-12-24 14:56:27 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Jan Lieskovsky 2009-12-04 13:40:46 UTC
Common Vulnerabilities and Exposures assigned an identifier CVE-2009-4193 to
the following vulnerability:

Merkaartor 0.14 allows local users to append data to arbitrary files
via a symlink attack on the /tmp/merkaartor.log temporary file.

References:
-----------
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4193
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=548546
http://www.securityfocus.com/bid/36529
http://osvdb.org/58389
http://secunia.com/advisories/36897
http://xforce.iss.net/xforce/xfdb/53486

Upstream bug report:
--------------------
http://trac.openstreetmap.org/ticket/2320

Comment 1 Jan Lieskovsky 2009-12-04 13:43:56 UTC
This issue affects the versions of the merkaartor, as shipped with
Fedora release of 10, 11, 12 and Fedora Rawhide.

Please fix once the patch is available.

Comment 2 Sven Lankes 2009-12-10 20:00:30 UTC
F-10 is not affected, as it ships with Merkaartor 0.13 which doesn't have said logging code.

Comment 3 Fedora Update System 2009-12-10 22:52:38 UTC
merkaartor-0.14-2.fc12 has been submitted as an update for Fedora 12.
http://admin.fedoraproject.org/updates/merkaartor-0.14-2.fc12

Comment 4 Fedora Update System 2009-12-10 22:53:31 UTC
merkaartor-0.14-2.fc11 has been submitted as an update for Fedora 11.
http://admin.fedoraproject.org/updates/merkaartor-0.14-2.fc11

Comment 5 Fedora Update System 2009-12-16 01:13:19 UTC
merkaartor-0.14-2.fc11 has been pushed to the Fedora 11 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 6 Fedora Update System 2009-12-16 01:13:30 UTC
merkaartor-0.14-2.fc12 has been pushed to the Fedora 12 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 7 Sven Lankes 2009-12-24 14:56:27 UTC
Looks like bodhi wasn't able to close this automatically because of the infrastructure move.

Closing ...