Bugzilla – Bug 120075
VUL-0: cfengine: insecure tmp file handling
Last modified: 2009-10-13 21:38:42 UTC
Hello Anna, we need to fix it for every SL version >= 9.0. - -------------------------------------------------------------------------- Debian Security Advisory DSA 835-1 security@debian.org http://www.debian.org/security/ Martin Schulze October 1st, 2005 http://www.debian.org/security/faq - -------------------------------------------------------------------------- Package : cfengine Vulnerability : insecure temporary files Problem type : local Debian-specific: no CVE ID : CAN-2005-2960 Javier Fernández-Sanguino Peña discovered several insecure temporary file uses in cfengine, a tool for configuring and maintaining networked machines, that can be exploited by a symlink attack to overwrite arbitrary files owned by the user executing cfengine, which is probably root. For the old stable distribution (woody) these problems have been fixed in version 1.6.3-9woody1. For the stable distribution (sarge) these problems have been fixed in version 1.6.5-1sarge1. For the unstable distribution (sid) these problems have will be fixed soon. We recommend that you upgrade your cfengine package. Upgrade Instructions - -------------------- wget url will fetch the file for you dpkg -i file.deb will install the referenced file. If you are using the apt-get package manager, use the line for sources.list as given below: apt-get update will update the internal database apt-get upgrade will install corrected packages You may use an automated update by adding the resources from the footer to the proper configuration. Debian GNU/Linux 3.0 alias woody - -------------------------------- Source archives: http://security.debian.org/pool/updates/main/c/cfengine/cfengine_1.6.3-9woody1.dsc Size/MD5 checksum: 697 bb2e5be7b89c57f6c4cf1e3738ecd922 http://security.debian.org/pool/updates/main/c/cfengine/cfengine_1.6.3-9woody1.diff.gz Size/MD5 checksum: 38077 1ae76d1eb77ebd60a3333c062a1a7c31 http://security.debian.org/pool/updates/main/c/cfengine/cfengine_1.6.3.orig.tar.gz Size/MD5 checksum: 867415 19079eafbee44e3d39308c086d4b539b etc.
fixes submitted
Thanks a lot! Maintenance-Tracker-2517 /work/src/done/PATCHINFO/cfengine.patch.box
The build failed for 9.2, 9.3 and 10.0. Please fix.
Apparently the strict checks were enabled also in old distributions, is it intentional?
"strict checks" = security fix? If so, yes then they are.
no, the checks for gcc warnings it should be fixed allready
i see. thanks.
updates approved
CVE-2005-2960: CVSS v2 Base Score: 2.1 (AV:L/AC:L/Au:N/C:N/I:P/A:N)