Bug 120075

Summary:	VUL-0: cfengine: insecure tmp file handling
Product:	[openSUSE] SUSE Linux 10.1	Reporter:	Thomas Biege <thomas>
Component:	Other	Assignee:	Security Team bot <security-team>
Status:	RESOLVED FIXED	QA Contact:	E-mail List <qa-bugs>
Severity:	Normal
Priority:	P5 - None	CC:	patch-request, security-team
Version:	unspecified
Target Milestone:	---
Hardware:	Other
OS:	All
Whiteboard:	CVE-2005-2960: CVSS v2 Base Score: 2.1 (AV:L/AC:L/Au:N/C:N/I:P/A:N)
Found By:	Other	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---

Description Thomas Biege 2005-10-04 09:57:59 UTC

Hello Anna,
we need to fix it for every SL version >= 9.0.


- --------------------------------------------------------------------------
Debian Security Advisory DSA 835-1                     security@debian.org
http://www.debian.org/security/                             Martin Schulze
October 1st, 2005                       http://www.debian.org/security/faq
- --------------------------------------------------------------------------

Package        : cfengine
Vulnerability  : insecure temporary files
Problem type   : local
Debian-specific: no
CVE ID         : CAN-2005-2960

Javier FernÃ¡ndez-Sanguino PeÃ±a discovered several insecure temporary
file uses in cfengine, a tool for configuring and maintaining
networked machines, that can be exploited by a symlink attack to
overwrite arbitrary files owned by the user executing cfengine, which
is probably root.

For the old stable distribution (woody) these problems have been fixed in
version 1.6.3-9woody1.

For the stable distribution (sarge) these problems have been fixed in
version 1.6.5-1sarge1.

For the unstable distribution (sid) these problems have will be fixed soon.

We recommend that you upgrade your cfengine package.

Upgrade Instructions
- --------------------

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
        will update the internal database
apt-get upgrade
        will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.


Debian GNU/Linux 3.0 alias woody
- --------------------------------

  Source archives:

   
http://security.debian.org/pool/updates/main/c/cfengine/cfengine_1.6.3-9woody1.dsc
      Size/MD5 checksum:      697 bb2e5be7b89c57f6c4cf1e3738ecd922
   
http://security.debian.org/pool/updates/main/c/cfengine/cfengine_1.6.3-9woody1.diff.gz
      Size/MD5 checksum:    38077 1ae76d1eb77ebd60a3333c062a1a7c31
   
http://security.debian.org/pool/updates/main/c/cfengine/cfengine_1.6.3.orig.tar.gz
      Size/MD5 checksum:   867415 19079eafbee44e3d39308c086d4b539b

etc.

Comment 1 Anna Maresova 2005-10-04 17:55:29 UTC

fixes submitted

Comment 2 Thomas Biege 2005-10-05 13:58:42 UTC

Thanks a lot!

Maintenance-Tracker-2517

/work/src/done/PATCHINFO/cfengine.patch.box

Comment 3 Michael Schröder 2005-10-06 16:05:45 UTC

The build failed for 9.2, 9.3 and 10.0. Please fix.

Comment 4 Anna Maresova 2005-10-07 17:50:51 UTC

Apparently the strict checks were enabled also in old distributions, is it
intentional?

Comment 5 Thomas Biege 2005-10-10 08:46:43 UTC

"strict checks" = security fix?
If so, yes then they are.

Comment 6 Marian Jancar 2005-10-10 15:00:24 UTC

no, the checks for gcc warnings
it should be fixed allready

Comment 7 Thomas Biege 2005-10-11 06:49:55 UTC

i see. thanks.

Comment 8 Marcus Meissner 2005-10-12 14:14:51 UTC

updates approved

Comment 9 Thomas Biege 2009-10-13 21:38:42 UTC

CVE-2005-2960: CVSS v2 Base Score: 2.1 (AV:L/AC:L/Au:N/C:N/I:P/A:N)