Your message dated Thu, 06 Nov 2008 22:17:11 +0000
with message-id <[EMAIL PROTECTED]>
and subject line Bug#504680: fixed in yzis 1.0~alpha1-2
has caused the Debian Bug report #504680,
regarding yzis: symlink attack vulnerability
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [EMAIL PROTECTED]
immediately.)
--
504680: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=504680
Debian Bug Tracking System
Contact [EMAIL PROTECTED] with problems
--- Begin Message ---
Source: yzis
Source-Version: 1.0~alpha1-1
Severity: serious
Tags: security
Hi,
This source (affecting all frontends) is vulnerable to a symlink attack.
The frontends (I guess the library might be doing this as it's the same
behaviour in all cases) writes to «/tmp/yzisdebug-$USER.log».
If we create a symlink pointing to some non-existent file, the frontend
will create it with zero length on startup but segfault immediately. On
the other hand if the symlink points to an existent file the frontends
will just remove the current symlink and create a new file ignoring
the pointed file.
So at least this can be used to create zero length files on behalf of
the user running the program.
The best fix would be to not write that debug log file at all.
regards,
guillem
--- End Message ---
--- Begin Message ---
Source: yzis
Source-Version: 1.0~alpha1-2
We believe that the bug you reported is fixed in the latest version of
yzis, which is due to be installed in the Debian FTP archive:
kyzis_1.0~alpha1-2_amd64.deb
to pool/main/y/yzis/kyzis_1.0~alpha1-2_amd64.deb
kyzis_1.0~alpha1-2_i386.deb
to pool/main/y/yzis/kyzis_1.0~alpha1-2_i386.deb
libyzis0_1.0~alpha1-2_amd64.deb
to pool/main/y/yzis/libyzis0_1.0~alpha1-2_amd64.deb
libyzis0_1.0~alpha1-2_i386.deb
to pool/main/y/yzis/libyzis0_1.0~alpha1-2_i386.deb
nyzis_1.0~alpha1-2_amd64.deb
to pool/main/y/yzis/nyzis_1.0~alpha1-2_amd64.deb
nyzis_1.0~alpha1-2_i386.deb
to pool/main/y/yzis/nyzis_1.0~alpha1-2_i386.deb
qyzis_1.0~alpha1-2_amd64.deb
to pool/main/y/yzis/qyzis_1.0~alpha1-2_amd64.deb
qyzis_1.0~alpha1-2_i386.deb
to pool/main/y/yzis/qyzis_1.0~alpha1-2_i386.deb
yzis-common_1.0~alpha1-2_all.deb
to pool/main/y/yzis/yzis-common_1.0~alpha1-2_all.deb
yzis_1.0~alpha1-2.diff.gz
to pool/main/y/yzis/yzis_1.0~alpha1-2.diff.gz
yzis_1.0~alpha1-2.dsc
to pool/main/y/yzis/yzis_1.0~alpha1-2.dsc
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [EMAIL PROTECTED],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Adrian Friedli <[EMAIL PROTECTED]> (supplier of updated yzis package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [EMAIL PROTECTED])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.8
Date: Thu, 06 Nov 2008 18:45:42 +0100
Source: yzis
Binary: yzis-common libyzis0 nyzis qyzis kyzis
Architecture: all amd64 i386 source
Version: 1.0~alpha1-2
Distribution: experimental
Urgency: medium
Maintainer: Adrian Friedli <[EMAIL PROTECTED]>
Changed-By: Adrian Friedli <[EMAIL PROTECTED]>
Closes: 504680
Description:
kyzis - editor inspired by vim - KDE frontend
libyzis0 - editor inspired by vim - core library
nyzis - editor inspired by vim - ncurses frontend
qyzis - editor inspired by vim - Qt frontend
yzis-common - editor inspired by vim - common files
Changes:
yzis (1.0~alpha1-2) experimental; urgency=medium
.
* Disable log file. Fixes symlink attack vulnerability. (Closes: #504680)
Checksums-Sha1:
0e027955bc86c74c21cf08d2c0e565621bc80ab5 83526 qyzis_1.0~alpha1-2_i386.deb
11e9ee37fb9886055936f80b53c216f8df8b0672 56328 nyzis_1.0~alpha1-2_amd64.deb
149498a2ea832c3d4b8569c32a623415a868e1c8 88652 qyzis_1.0~alpha1-2_amd64.deb
255df0fc02a7201b19e49d785ca14b6ae86a12ab 75830 kyzis_1.0~alpha1-2_i386.deb
31374a72b3fdadff32ad4d862490feebd4a4390e 80550 kyzis_1.0~alpha1-2_amd64.deb
9d86fdb243291ff2dd1f281000d88f682fb8b948 53248 nyzis_1.0~alpha1-2_i386.deb
b38debf9391e9a3529b049d1d1251989a58a79ee 423848 libyzis0_1.0~alpha1-2_i386.deb
c2804965a280617bc6cc1eb1fa22360b3c73f5f4 446950 libyzis0_1.0~alpha1-2_amd64.deb
d9781c7d995bfc84cb1607d192661cf0d386cfc4 6284 yzis_1.0~alpha1-2.diff.gz
339bd7a357a63e188de5efa6e1c2c8aa3b62183a 1297 yzis_1.0~alpha1-2.dsc
fc357db07d6a8d2bdf2ec72d887233f7cd9ec153 405044
yzis-common_1.0~alpha1-2_all.deb
Checksums-Sha256:
3b749f37f148e0aad879501282585dee9d9f364f45249cc5ad633f4b00e11df8 423848
libyzis0_1.0~alpha1-2_i386.deb
419a63f51eb72c3108cba26c22025f90c323553355bea420646675577cf958df 405044
yzis-common_1.0~alpha1-2_all.deb
65934e64639900789417b7d8b14534739681990beff0fbdce7c72e4150590065 80550
kyzis_1.0~alpha1-2_amd64.deb
6db37d5c7d05f910bbdc328912a0db0b5b3380ae7c729fce30db8f6d0c600e2c 75830
kyzis_1.0~alpha1-2_i386.deb
465fba32834d946649b45f3e5a149c5a27d6f95d803fff26fbf48ddb65d65d03 1297
yzis_1.0~alpha1-2.dsc
7d7a467c770ce6fd45b19c4651433f3283bf2789b89c5867be1759ee4dcd6f6e 6284
yzis_1.0~alpha1-2.diff.gz
875dffcee19005341ea5880cef94090221a4dfc40e82c7dfb0c07c6754301475 446950
libyzis0_1.0~alpha1-2_amd64.deb
88a487dfc0d64dd2bac477205c7df53917166664e81c62db2ac0da25b3416ded 83526
qyzis_1.0~alpha1-2_i386.deb
b449c0b9a24d0f4732bd6dc60c25303f9e0a1e85c99f96403fcc2c00b2be6cdc 56328
nyzis_1.0~alpha1-2_amd64.deb
cab91646fae1dc958379db978885785d27f80773e4b3fd0b4b14107934466913 53248
nyzis_1.0~alpha1-2_i386.deb
dade5111a74d4e67c22368e4b7b342432ac52e3b5356cdf9c8f8314119d344af 88652
qyzis_1.0~alpha1-2_amd64.deb
Files:
03f66f5636a50302f9158341083bd3f3 423848 editors optional
libyzis0_1.0~alpha1-2_i386.deb
28ae24d9a07c9a2ea31e3ea7de23556f 6284 editors optional
yzis_1.0~alpha1-2.diff.gz
3218770f7804df3e8f39d7aadd74b36a 80550 editors optional
kyzis_1.0~alpha1-2_amd64.deb
3732066ceaaafbafff3ac802f71e8143 53248 editors optional
nyzis_1.0~alpha1-2_i386.deb
5e1a689789f025859b7589cdfd8f2888 88652 editors optional
qyzis_1.0~alpha1-2_amd64.deb
5b1a318ed9602f1878c768f4b4901017 1297 editors optional yzis_1.0~alpha1-2.dsc
8e6f960a39edcf6ab3d2527b5343f122 83526 editors optional
qyzis_1.0~alpha1-2_i386.deb
9c87844dcc267bd7861f34d4b8bace5f 446950 editors optional
libyzis0_1.0~alpha1-2_amd64.deb
a6afc69ddfa7f1f0db8de78b50d134c1 75830 editors optional
kyzis_1.0~alpha1-2_i386.deb
adffc97b19c36e24e70de94defad951c 405044 editors optional
yzis-common_1.0~alpha1-2_all.deb
bc40c39394b209cbfd67d1b2787cf081 56328 editors optional
nyzis_1.0~alpha1-2_amd64.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
iEYEARECAAYFAkkTa00ACgkQnMvaFgH6i0pslwCePHbq1u77Zc0XDQbpJI2+1lln
sLgAnRpFAV500sbw27pJieqa/eQyDCdP
=xFSV
-----END PGP SIGNATURE-----
--- End Message ---
