Package: sympa Version: 5.3.4-5.1 Severity: critical Tags: security Justification: root security hole
AFAICT (and thanks to Thijs Kinkhorst <[EMAIL PROTECTED]> : http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=494969#21) there are more insecure use of /tmp in sympa. One quite nasty is the one in /usr/lib/sympa/bin/sympa_wizard.pl, as this script is used during sympa's postinst, so with root provileges, IMHO. Note that the sympa_wizard.pl which needs to be fixed is in debian/ in package sources (see #496514). Still, the insecure code is also present in upstream's sympa_wizard.pl. Will file separate report for another issue found with less critical severity. Hope this helps -- System Information: Debian Release: lenny/sid APT prefers testing-proposed-updates APT policy: (500, 'testing-proposed-updates'), (500, 'testing') Architecture: i386 (i686) Kernel: Linux 2.6.24-openvz-24-004.1d1-686 (SMP w/2 CPU cores) Locale: LANG=fr_FR.UTF-8, LC_CTYPE=fr_FR.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/bash Versions of packages sympa depends on: ii adduser 3.110 add and remove users and groups ii debconf [debconf-2.0] 1.5.22 Debian configuration management sy ii exim4-daemon-light [mail-tra 4.69-6 lightweight Exim MTA (v4) daemon pn libarchive-zip-perl <none> (no description available) ii libc6 2.7-13 GNU C Library: Shared libraries pn libcgi-fast-perl <none> (no description available) pn libcrypt-ciphersaber-perl <none> (no description available) pn libdbd-mysql-perl | libdbd-p <none> (no description available) ii libdbi-perl 1.605-1 Perl5 database interface by Tim Bu ii libfcgi-perl 0.67-2.1+b1 FastCGI Perl module ii libintl-perl 1.16-4 Uniforum message translations syst ii libio-stringy-perl 2.110-4 Perl modules for IO from scalars a ii libmailtools-perl 2.03-1 Manipulate email in perl programs pn libmd5-perl <none> (no description available) ii libmime-tools-perl [libmime- 5.427-1 Perl5 modules for MIME-compliant m pn libmsgcat-perl <none> (no description available) pn libnet-ldap-perl <none> (no description available) pn libtemplate-perl <none> (no description available) ii libxml-libxml-perl 1.66-1+b1 Perl module for using the GNOME li pn mhonarc <none> (no description available) ii perl [libmime-base64-perl] 5.10.0-13 Larry Wall's Practical Extraction pn perl-suid <none> (no description available) ii sysklogd [system-log-daemon] 1.5-5 System Logging Daemon Versions of packages sympa recommends: ii doc-base 0.8.16 utilities to manage online documen ii logrotate 3.7.1-3 Log rotation utility Versions of packages sympa suggests: ii apache2-mpm-prefork [httpd] 2.2.9-7 Apache HTTP Server - traditional n pn libapache-mod-fastcgi <none> (no description available) pn mysql-server | postgresql <none> (no description available) ii openssl 0.9.8g-13 Secure Socket Layer (SSL) binary a -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
