Bug 502174 - (CVE-2009-1753) CVE-2009-1753 Coccinelle: Insecure /tmp file use
CVE-2009-1753 Coccinelle: Insecure /tmp file use
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
low Severity low
: ---
: ---
Assigned To: Richard W.M. Jones
http://packages.qa.debian.org/c/cocci...
reported=20090506,public=20090502,sou...
: Security
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2009-05-22 06:44 EDT by Jan Lieskovsky
Modified: 2015-08-21 19:05 EDT (History)
1 user (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2015-08-21 19:05:46 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
Patch extracted from Debian counterpart (coccinelle_0.1.7.deb-3.diff.gz ) (1.07 KB, patch)
2009-05-22 06:46 EDT, Jan Lieskovsky
no flags Details | Diff

  None (edit)
Description Jan Lieskovsky 2009-05-22 06:44:27 EDT
Common Vulnerabilities and Exposures assigned an identifier CVE-2009-1753 to
the following vulnerability:

Coccinelle 0.1.7 allows local users to overwrite arbitrary files via a
symlink attack on an unspecified "result file." 

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1753
http://www.openwall.com/lists/oss-security/2009/05/06/2
http://packages.qa.debian.org/c/coccinelle/news/20090502T001704Z.html
http://packages.debian.org/changelogs/pool/main/c/coccinelle/coccinelle_0.1.7.deb-3/changelog
http://www.securityfocus.com/bid/34848
http://secunia.com/advisories/35012
Comment 1 Jan Lieskovsky 2009-05-22 06:46:34 EDT
Created attachment 345076 [details]
Patch extracted from Debian counterpart (coccinelle_0.1.7.deb-3.diff.gz )

Url the coccinelle_0.1.7.deb-3.diff.gz was retrieved from:

http://mirror.aarnet.edu.au/debian/pool/main/c/coccinelle/
Comment 2 Richard W.M. Jones 2009-05-22 06:54:52 EDT
I'll push out an updated build now.
Comment 3 Richard W.M. Jones 2009-05-22 06:59:28 EDT
BTW, I think that patch is totally bogus.  I'll have a
chat with upstream & Debian devs about this.
Comment 4 Jan Lieskovsky 2009-05-22 07:19:08 EDT
Yeah, from quick look at the patch, looks like it only "comments out" the 
relevant part. Need to admit, don't understand the *.ml syntax :(.
Comment 5 Richard W.M. Jones 2009-05-22 07:24:44 EDT
I've chatted with a Debian developer, and we agree
that the patch is 'correct', in that it fixes the
vulnerability, by just chopping out that bit of
functionality.

So I'm going to go with the patch, and let upstream
come up with a real fix that includes the functionality
(saving intermediate files in /tmp in a safe way).
Comment 6 Fedora Update System 2009-05-22 08:05:31 EDT
coccinelle-0.1.8-1.fc11.3 has been submitted as an update for Fedora 11.
http://admin.fedoraproject.org/updates/coccinelle-0.1.8-1.fc11.3
Comment 7 Richard W.M. Jones 2009-05-22 08:09:11 EDT
I've requested that this gets pushed straight into
the F11 builds.

https://fedorahosted.org/rel-eng/ticket/1867
Comment 8 Fedora Update System 2009-06-15 22:44:45 EDT
coccinelle-0.1.8-1.fc10.3 has been pushed to the Fedora 10 stable repository.  If problems still persist, please make note of it in this bug report.

Note You need to log in before you can comment on or make changes to this bug.