Bug#496363: The possibility of attack with the help of symlinks in some Debian packages

2008-08-27 Thread Dirk Eddelbuettel
Hi Thijs, On 27 August 2008 at 13:57, Thijs Kinkhorst wrote: | Hi Dirk, | | On Monday 25 August 2008 13:57, Dirk Eddelbuettel wrote: | > Upstream covers more than just Linux distros: Aix, Solaris, OS X, HP-UX, | > ... and even Windoze (though the javareconf script may not matter there). | > | >

Bug#496363: The possibility of attack with the help of symlinks in some Debian packages

2008-08-27 Thread Thijs Kinkhorst
Hi Dirk, On Monday 25 August 2008 13:57, Dirk Eddelbuettel wrote: > Upstream covers more than just Linux distros: Aix, Solaris, OS X, HP-UX, > ... and even Windoze (though the javareconf script may not matter there). > > But I just emailed the point person for javareconf. Maybe we can move > creat

Bug#496363: The possibility of attack with the help of symlinks in some Debian packages

2008-08-25 Thread Dirk Eddelbuettel
On 25 August 2008 at 13:44, Thijs Kinkhorst wrote: | On Monday 25 August 2008 13:36, Dirk Eddelbuettel wrote: | > On 25 August 2008 at 13:19, Thijs Kinkhorst wrote: | > | >Trouble is that we then accumulate yet another Debian-only patch... Oh | > | > well. | > | | > | Why wouldn't it be acceptable

Bug#496363: The possibility of attack with the help of symlinks in some Debian packages

2008-08-25 Thread Thijs Kinkhorst
On Monday 25 August 2008 13:36, Dirk Eddelbuettel wrote: > On 25 August 2008 at 13:19, Thijs Kinkhorst wrote: > | >Trouble is that we then accumulate yet another Debian-only patch... Oh > | > well. > | > | Why wouldn't it be acceptable to upstream? > > I'll talk to them but mktemp is not universal,

Bug#496363: The possibility of attack with the help of symlinks in some Debian packages

2008-08-25 Thread Dirk Eddelbuettel
On 25 August 2008 at 13:19, Thijs Kinkhorst wrote: | >Trouble is that we then accumulate yet another Debian-only patch... Oh well. | | Why wouldn't it be acceptable to upstream? I'll talk to them but mktemp is not universal, is it? | > So something like | > | > # test functionality of the comp

Bug#496363: The possibility of attack with the help of symlinks in some Debian packages

2008-08-25 Thread Nico Golde
Hi Dirk, * Dirk Eddelbuettel <[EMAIL PROTECTED]> [2008-08-25 13:06]: > On 25 August 2008 at 04:11, Nico Golde wrote: > | * Dirk Eddelbuettel <[EMAIL PROTECTED]> [2008-08-25 03:07]: [...] > | > Right before /tmp/A.* are being used, they are being wiped. No symlink > | > attack. > | > > | > Unless

Bug#496363: The possibility of attack with the help of symlinks in some Debian packages

2008-08-25 Thread Thijs Kinkhorst
>Trouble is that we then accumulate yet another Debian-only patch... Oh well. Why wouldn't it be acceptable to upstream? > So something like > > # test functionality of the compiler > javac_works='not present' > if test -n "$JAVAC"; then > javac_works='not functional' > #rm -rf /tmp/A.jav

Bug#496363: The possibility of attack with the help of symlinks in some Debian packages

2008-08-24 Thread Dirk Eddelbuettel
On 25 August 2008 at 04:11, Nico Golde wrote: | Hi Dirk, | * Dirk Eddelbuettel <[EMAIL PROTECTED]> [2008-08-25 03:07]: | > I think it is a false positive: | > | > # test functionality of the compiler | > javac_works='not present' | > if test -n "$JAVAC"; then | > javac_works='not functional'

Bug#496363: The possibility of attack with the help of symlinks in some Debian packages

2008-08-24 Thread Nico Golde
Hi Dirk, * Dirk Eddelbuettel <[EMAIL PROTECTED]> [2008-08-25 03:07]: > I think it is a false positive: > > # test functionality of the compiler > javac_works='not present' > if test -n "$JAVAC"; then > javac_works='not functional' > rm -rf /tmp/A.java /tmp/A.class ## <- note the

Bug#496363: The possibility of attack with the help of symlinks in some Debian packages

2008-08-24 Thread Dirk Eddelbuettel
I think it is a false positive: # test functionality of the compiler javac_works='not present' if test -n "$JAVAC"; then javac_works='not functional' rm -rf /tmp/A.java /tmp/A.class ## <- note the rm -rf echo "public class A { }" > /tmp/A.java if test -e /tmp/A.java; the

Bug#496363: The possibility of attack with the help of symlinks in some Debian packages

2008-08-24 Thread Dmitry E. Oboukhov
Package: r-base-core-ra Severity: grave Hi, maintainer! This message about the error concerns a few packages at once. I've tested all the packages (for Lenny) on my Debian mirror. All scripts of packages (marked as executable) were tested. In some packages I've discovered scripts with erro