Attachment 27615 Details for Bug 64800

[patch] patch.CAN-2005-0004.mysql

patch.CAN-2005-0004.mysql (text/plain), 2.58 KB, created by Ludwig Nussel on 2005-01-13 20:08:00 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Ludwig Nussel

Created: 2005-01-13 20:08:00 UTC

Size: 2.58 KB

patch

obsolete

>diff -u mysql-3.23.49/debian/changelog mysql-3.23.49/debian/changelog
>--- mysql-3.23.49/debian/changelog
>+++ mysql-3.23.49/debian/changelog
>@@ -1,3 +1,16 @@
>+mysql (3.23.49-8.9) stable-security; urgency=high
>+
>+  * Maintainer upload for the Security Team
>+  * Javier Fernandez-Sanguino Pena from the Debian Security Audit Project
>+    found a /tmp symlink vulnerability in the mysqlaccess script that could
>+    allow an unprivileged user to let root overwrite arbitrary files without
>+    his knowledge and also could unveil the contents of a temporary file which
>+    might contain sensitive information.
>+    [scripts/mysqlaccess.sh, CAN-2005-0004]
>+  * Added older security patches to debian/patches for reference
>+
>+ -- Christian Hammers <ch@debian.org>  Thu, 13 Jan 2005 02:50:21 +0100
>+
> mysql (3.23.49-8.8) stable-security; urgency=high
> 
>   * Maintainer upload by the Security Team
>only in patch2:
>unchanged:
>--- mysql-3.23.49.orig/scripts/mysqlaccess.sh
>+++ mysql-3.23.49/scripts/mysqlaccess.sh
>@@ -3,6 +3,7 @@
> package MySQLaccess;
> #use strict;
> use POSIX qw(tmpnam);
>+use File::Temp qw/ tempfile tempdir /;
> use Fcntl;
> 
> BEGIN {
>@@ -32,7 +33,6 @@
> 	$ACCESS_U_BCK = 'user_backup';   
> 	$ACCESS_D_BCK = 'db_backup';     
>         $DIFF      = '/usr/bin/diff'; 
>-        $TMP_PATH  = '/tmp';             #path to writable tmp-directory
>         $MYSQLDUMP = '@bindir@/mysqldump';
>                                          #path to mysqldump executable
> 
>@@ -577,8 +577,6 @@
> push(@MySQLaccess::Grant::Error,'not_found_mysql')     if !(-x $MYSQL);
> push(@MySQLaccess::Grant::Error,'not_found_diff')      if !(-x $DIFF);
> push(@MySQLaccess::Grant::Error,'not_found_mysqldump') if !(-x $MYSQLDUMP);
>-push(@MySQLaccess::Grant::Error,'not_found_tmp')       if !(-d $TMP_PATH);
>-push(@MySQLaccess::Grant::Error,'write_err_tmp')       if !(-w $TMP_PATH);
> if (@MySQLaccess::Grant::Error) {
>    MySQLaccess::Report::Print_Error_Messages() ;
>    exit 0;
>@@ -1777,9 +1775,10 @@
>    @before = sort(@before);
>    @after  = sort(@after);
> 
>-   $before = "$MySQLaccess::TMP_PATH/$MySQLaccess::script.before.$$";
>-   $after  = "$MySQLaccess::TMP_PATH/$MySQLaccess::script.after.$$";
>-   #$after = "/tmp/t0";
>+   $before = new File::Temp ( Template => "$MySQLaccess::script.XXXXXX", SUFFIX => ".before" ) or
>+    die "Cannot create temporary file: $!" ;
>+   $after = new File::Temp ( Template => "$MySQLaccess::script.XXXXXX", SUFFIX => ".after" ) or 
>+    die "Cannot create temporary file: $!" ;
>    open(BEFORE,"> $before") ||
>     push(@MySQLaccess::Report::Errors,"Can't open temporary file $before for writing");
>    open(AFTER,"> $after") ||

Actions: View | Diff

Attachments on bug 64800: 27615