Bug#496387: The possibility of attack with the help of symlinks in some Debian packages

[Dmitry E. Oboukhov]

please recheck src-code

for example:
        wims/src/Texgif/texgif.c

char *tmpdir="/tmp";
char *fontdir="/tmp";
char *headerfile="";
char *texstyle="";
char *outfile="/tmp/texgif.gif";
...


make grep /tmp for all sources :)


On 11:06 Mon 25 Aug     , Georges Khaznadar wrote:
GK> Hello Dmitri,

GK> wget downloads the description file easily:
GK> -------------------8<---------------------
GK> gk:/tmp$ LC_ALL=C wget 
ftp://debian.ofset.org/debian/pool/main/w/wims_3.62-15.dsc
GK> --2008-08-25 11:00:51--  
ftp://debian.ofset.org/debian/pool/main/w/wims_3.62-15.dsc
GK>> `wims_3.62-15.dsc'
GK> Resolving debian.ofset.org... 131.246.124.227
GK> Connecting to debian.ofset.org|131.246.124.227|:21... connected.
GK> Logging in as anonymous ... Logged in!
GK>> SYST ... done.    ==> PWD ... done.
GK>> TYPE I ... done.  ==> CWD /debian/pool/main/w ... done.
GK>> SIZE wims_3.62-15.dsc ... 411
GK>> PASV ... done.    ==> RETR wims_3.62-15.dsc ... done.
GK> Length: 411

GK> 100%[======================================>] 411         --.-K/s   in 
0.001s

GK> 2008-08-25 11:00:52 (507 KB/s) - `wims_3.62-15.dsc' saved [411]
GK> -------------------8<---------------------

GK> However nor dget, neither curl do succeed to access the same URL. I suppose
GK> that it is due to some misconfiguration of our ftp server, but I ignore 
which
GK> configuration is wrong. If you wan I can send you the files directly.

GK> Best regards,                       Georges.

GK> Dmitry E. Oboukhov a écrit :
GK>>> please can you sponsor the new package? The description file is at
GK>>> ftp://debian.ofset.org/debian/pool/main/w/wims_3.62-15.dsc
GK>> 
GK>> $ dget ftp://debian.ofset.org/debian/pool/main/w/wims_3.62-15.dsc
GK>> dget: retrieving
GK>> ftp://debian.ofset.org/debian/pool/main/w/wims_3.62-15.dsc
GK>> 
GK>> curl: (67) Access denied: 530
GK>> dget: curl wims_3.62-15.dsc
GK>> ftp://debian.ofset.org/debian/pool/main/w/wims_3.62-15.dsc failed
GK>> 
GK>> sorry, i cannot download it :(
GK>> --
GK>> 
GK>> . ''`. Dmitry E. Oboukhov
GK>> : :’  : [EMAIL PROTECTED]
GK>> `. `~’ GPGKey: 1024D / F8E26537 2006-11-21
GK>>   `- 1B23 D4F8 8EC0 D902 0555  E438 AB8C 00CF F8E2 6537
--

. ''`. Dmitry E. Oboukhov
: :’  : [EMAIL PROTECTED]
`. `~’ GPGKey: 1024D / F8E26537 2006-11-21
  `- 1B23 D4F8 8EC0 D902 0555  E438 AB8C 00CF F8E2 6537

signature.asc
Description: Digital signature