Your message dated Mon, 11 Aug 2008 11:08:12 +0200
with message-id <[EMAIL PROTECTED]>
and subject line Re: Bug#494649: The possibility of attack with the help of
symlinks in some Debian packages
has caused the Debian Bug report #494649,
regarding The possibility of attack with the help of symlinks in some Debian
packages
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [EMAIL PROTECTED]
immediately.)
--
494649: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=494649
Debian Bug Tracking System
Contact [EMAIL PROTECTED] with problems
--- Begin Message ---
Package: ppp
Severity: grave
Tags: security
This message about the error concerns a few packages at once. I've
tested all the packages on my Debian mirror. (post|pre)(inst|rm) and
config scripts were tested.
In some packages I've discovered scripts with errors which may be used
by a user for damaging important system files.
For example if a script uses in its work a temp file which is created
in /tmp directory, then every user can create symlink with the same
name in this directory in order to destroy or rewrite some system
file.
I set Severity into grave for this bug. The table of discovered
problems is below.
+------------------+-----------------+----------------------------------
| package | script | file for attack
+------------------+-----------------+----------------------------------
| mplayer-1.0~rc2 | config | /tmp/HACK (pipe)
| | |
| nws-2.13 | postinst | /tmp/nws.debug (cp)
| | |
| ppp-2.4.4rel | postinst | /tmp/probe-finished (rm -f, pipe)
| | postinst | /tmp/ppp-errors (rm -f, pipe)
| ppp-udeb | /etc/ppp/ip-up | /tmp/resolv.conf.tmp (cp)
| | |
| twiki-4.1.2 | postinst | /tmp/twiki (chmod 1777, chown)
+------------------+-----------------+----------------------------------
--- End Message ---
--- Begin Message ---
On Aug 11, "Dmitry E. Oboukhov" <[EMAIL PROTECTED]> wrote:
> In some packages I've discovered scripts with errors which may be used
> by a user for damaging important system files.
This is not relevant for udebs since there are no users on d-i systems.
--
ciao,
Marco
signature.asc
Description: Digital signature
--- End Message ---
