Bug 874798 (CVE-2014-2893)

Summary: VUL-0: CVE-2014-2893: llvm: insecure temporary file handling in clang's scan-build utility
Product: [Novell Products] SUSE Security Incidents Reporter: Alexander Bergmann <abergmann>
Component: IncidentsAssignee: Ismail Dönmez <ismail>
Status: RESOLVED FIXED QA Contact: Security Team bot <security-team>
Severity: Minor    
Priority: P3 - Medium CC: smash_bz
Version: unspecified   
Target Milestone: ---   
Hardware: Other   
OS: openSUSE 13.1   
URL: https://smash.suse.de/issue/98099/
Found By: Security Response Team Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---

Description Alexander Bergmann 2014-04-23 12:35:28 UTC
Via rh#1088105:

Jakub Wilk discovered that clang's scan-build utility insecurely handled temporary files. A local attacker could use this flaw to perform a symbolic link attack against users running the scan-build utility.

Original report: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=744817

CVE-2014-2893 was assigned to this issue.

Comment 1 Swamp Workflow Management 2014-04-23 22:00:59 UTC
bugbot adjusting priority
Comment 2 Marcus Meissner 2014-06-17 05:24:07 UTC
On 16/06/2014 22:51, Sylvestre Ledru wrote:
> On 19/04/2014 05:29, cve-assign@mitre.org wrote:
>>> Jakub Wilk discovered that clang's scan-build utility insecurely handled
>>> temporary files.
>>> https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=744817
>>> The GetHTMLRunDir subroutine ...
>>> 3) The function doesn't fail if the directory already exists, even if
>>> it's owned by another user.
>> Use CVE-2014-2893.
> I think I fixed it upstream:
> http://llvm.org/viewvc/llvm-project?view=revision&revision=211051
> http://llvm.org/viewvc/llvm-project/cfe/trunk/tools/scan-build/scan-build?r1=210971&r2=211051&pathrev=211051
Actual patch fixed:
Sorry about the noise

Comment 3 Ismail Dönmez 2015-01-29 12:18:04 UTC
https://build.opensuse.org/request/show/283312 submitted.
Comment 4 Ismail Dönmez 2015-01-30 14:33:55 UTC
Update submitted.
Comment 5 Swamp Workflow Management 2015-02-09 17:06:20 UTC
openSUSE-SU-2015:0245-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 874798
CVE References: CVE-2014-2893
Sources used:
openSUSE 13.1 (src):    llvm-3.3-6.7.1