Hello community, here is the log from the commit of package gdm for openSUSE:11.4 checked in at Thu Mar 31 00:46:57 CEST 2011.
-------- --- old-versions/11.4/all/gdm/gdm.changes 2011-02-15 13:33:03.000000000 +0100 +++ 11.4/gdm/gdm.changes 2011-03-30 09:35:33.000000000 +0200 @@ -1,0 +2,7 @@ +Wed Mar 30 07:02:29 UTC 2011 - [email protected] + +- Add gdm-CVE-2011-0727-bnc679786.patch: worker: change to a user + before copying user files to prevent a possible symlink local + root exploit attack. CVE-2011-0727, bnc#679786. + +------------------------------------------------------------------- Package does not exist at destination yet. Using Fallback old-versions/11.4/all/gdm Destination is old-versions/11.4/UPDATES/all/gdm calling whatdependson for 11.4-i586 New: ---- gdm-CVE-2011-0727-bnc679786.patch ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ gdm.spec ++++++ --- /var/tmp/diff_new_pack.tbt3Fk/_old 2011-03-31 00:46:30.000000000 +0200 +++ /var/tmp/diff_new_pack.tbt3Fk/_new 2011-03-31 00:46:30.000000000 +0200 @@ -42,7 +42,7 @@ License: GPLv2+ Group: System/GUI/GNOME Version: 2.32.0 -Release: 9.<RELEASE3> +Release: 9.<RELEASE14> Summary: The GNOME Display Manager Source: %{name}-%{version}.tar.bz2 Source1: gdm.pamd @@ -89,6 +89,8 @@ Patch40: gdm-look-at-runlevel.patch # PATCH-FIX-OPENSUSE gdm-selinux.patch -- Small changes to make it compile fine with SELinux Patch60: gdm-selinux.patch +# PATCH-FIX-UPSTREAM gdm-CVE-2011-0727-bnc679786.patch CVE-2011-0727 bnc#679687 [email protected] -- Change to user before copying user files. +Patch61: gdm-CVE-2011-0727-bnc679786.patch Url: http://www.gnome.org/ BuildRoot: %{_tmppath}/%{name}-%{version}-build DocDir: %{_defaultdocdir} @@ -171,6 +173,7 @@ %patch37 -p1 %patch40 -p1 %patch60 +%patch61 -p1 #gnome-patch-translation-update %build ++++++ gdm-CVE-2011-0727-bnc679786.patch ++++++ >From c122ebed451272090e594f3a511cc8a6017a62e2 Mon Sep 17 00:00:00 2001 From: Ray Strode <[email protected]> Date: Thu, 24 Mar 2011 16:47:37 -0400 Subject: [PATCH] worker: CVE-2011-0727: change to user before copying user files This commit changes to a user before copying user files to prevent a possible symlink local root exploit attack. --- daemon/gdm-session-worker.c | 29 +++++++++++++++++------------ 1 files changed, 17 insertions(+), 12 deletions(-) diff --git a/daemon/gdm-session-worker.c b/daemon/gdm-session-worker.c index 35a6bfe..7c5b0b5 100644 --- a/daemon/gdm-session-worker.c +++ b/daemon/gdm-session-worker.c @@ -1035,17 +1035,6 @@ gdm_cache_copy_file (GdmSessionWorker *worker, error->message); g_error_free (error); } else { - int res; - - res = chown (cachefilename, - worker->priv->uid, - worker->priv->gid); - if (res == -1) { - g_warning ("GdmSessionWorker: Error setting owner of cache file: %s", - g_strerror (errno)); - } - - g_chmod (cachefilename, S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH); g_debug ("Copy successful"); } @@ -1183,7 +1172,23 @@ gdm_session_worker_uninitialize_pam (GdmSessionWorker *worker, return; if (worker->priv->state >= GDM_SESSION_WORKER_STATE_SESSION_OPENED) { - gdm_session_worker_cache_userfiles (worker); + pid_t pid; + + pid = fork (); + + if (pid == 0) { + if (setuid (worker->priv->uid) < 0) { + g_debug ("GdmSessionWorker: could not reset uid: %s", g_strerror (errno)); + _exit (1); + } + + gdm_session_worker_cache_userfiles (worker); + _exit (0); + } + + if (pid > 0) { + gdm_wait_on_pid (pid); + } pam_close_session (worker->priv->pam_handle, 0); gdm_session_auditor_report_logout (worker->priv->auditor); -- 1.7.1 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Remember to have fun... -- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
