This service will be undergoing maintenance at 00:00 UTC, 2016-08-01. It is expected to last about 1 hours

Bug 709413 (CVE-2009-5044)

Summary: CVE-2009-5044 groff: insecure temporary file handling in pdfroff
Product: [Other] Security Response Reporter: Vincent Danen <vdanen>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: jrusnack
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard: public=20090724,reported=20110112,source=oss-security,impact=low,cvss2=1.9/AV:L/AC:M/Au:N/C:N/I:P/A:N,fedora-14/groff=affected,fedora-15/groff=affected,rhel-6/groff=notaffected,rhel-5/groff=notaffected,rhel-4/groff=notaffected,cwe=CWE-377
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Bug Depends On: 709414, 709415    
Bug Blocks:    

Description Vincent Danen 2011-05-31 12:32:47 EDT
A Debian bug report [1] indicated that the pdfroff utility uses $$ (the current process's PID) to create predictable temporary files.

pdfroff is not included in older versions of groff as provided with Red Hat Enterprise Linux 6 or earlier (1.18.1), but is included in 1.20 and higher, so Fedora 14 and higher are affected.

As well, older groff includes the groff-1.18.1.4-sectmp.patch patch which fixes other temporary file issues, however Fedora 14 and higher do not include a similar patch.  Recommend using the Openwall patch [2] in Fedora 14 and higher to secure this flaw and other temporary file issues that had previously been protected with the aforementioned patch.

[1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=538330
[2] http://cvsweb.openwall.com/cgi/cvsweb.cgi/Owl/packages/groff/groff-1.20.1-owl-tmp.diff?rev=1.2;content-type=text%2Fplain


Statement:

Not vulnerable. This issue did not affect the versions of groff as shipped with Red Hat Enterprise Linux 4, 5, or 6.
Comment 1 Vincent Danen 2011-05-31 12:34:07 EDT
Created groff tracking bugs for this issue

Affects: fedora-14 [bug 709414]
Affects: fedora-15 [bug 709415]
Comment 2 Fedora Update System 2012-06-07 19:01:13 EDT
groff-1.21-4.fc15 has been pushed to the Fedora 15 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 3 Fedora Update System 2012-06-07 19:03:53 EDT
groff-1.21-4.fc16 has been pushed to the Fedora 16 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 4 Fedora Update System 2012-06-07 19:08:28 EDT
groff-1.21-9.fc17 has been pushed to the Fedora 17 stable repository.  If problems still persist, please make note of it in this bug report.