Your message dated Sun, 10 Jan 2010 23:33:50 +0000
with message-id <[email protected]>
and subject line Bug#508940: fixed in netdisco-mibs-installer 1.4
has caused the Debian Bug report #508940,
regarding CVE-2008-5379: Symlink attack
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
508940: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=508940
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: netdisco-mibs-installer
Severity: grave
Tags: security
Justification: user security hole
Hi,
the following CVE (Common Vulnerabilities & Exposures) id was
published for netdisco-mibs-installer.
CVE-2008-5379[0]:
| netdisco-mibs-installer 1.0 allows local users to overwrite arbitrary
| files via a symlink attack on the /tmp/netdisco-mibs-0.6.tar.gz
| temporary file, related to the (1) netdisco-mibs-install and (2)
| netdisco-mibs-download scripts.
The best way is to use mktemp in shell scripts, which should work for
this package too.
If you fix the vulnerability please also make sure to include the
CVE id in your changelog entry.
Cheers
Steffen
For further information see:
[0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5379
http://security-tracker.debian.net/tracker/CVE-2008-5379
--- End Message ---
--- Begin Message ---
Source: netdisco-mibs-installer
Source-Version: 1.4
We believe that the bug you reported is fixed in the latest version of
netdisco-mibs-installer, which is due to be installed in the Debian FTP archive:
netdisco-mibs-installer_1.4.dsc
to contrib/n/netdisco-mibs-installer/netdisco-mibs-installer_1.4.dsc
netdisco-mibs-installer_1.4.tar.gz
to contrib/n/netdisco-mibs-installer/netdisco-mibs-installer_1.4.tar.gz
netdisco-mibs-installer_1.4_all.deb
to contrib/n/netdisco-mibs-installer/netdisco-mibs-installer_1.4_all.deb
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Christoph Martin <[email protected]> (supplier of updated
netdisco-mibs-installer package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: RIPEMD160
Format: 1.8
Date: Mon, 11 Jan 2010 00:16:14 +0100
Source: netdisco-mibs-installer
Binary: netdisco-mibs-installer
Architecture: source all
Version: 1.4
Distribution: unstable
Urgency: high
Maintainer: Oliver Gorwits <[email protected]>
Changed-By: Christoph Martin <[email protected]>
Description:
netdisco-mibs-installer - Netdisco MIB bundle installer package
Closes: 508940
Changes:
netdisco-mibs-installer (1.4) unstable; urgency=high
.
* apply fix for CVE-2008-5379: Symlink attack (closes: #508940)
Checksums-Sha1:
bec395ec51ef93401d16c97504615a621d433593 1013 netdisco-mibs-installer_1.4.dsc
423c6e79050ec473ebd424da8c88e26b55417085 6441
netdisco-mibs-installer_1.4.tar.gz
1da383f59463318ac5c2289b477a740cc45abff7 12780
netdisco-mibs-installer_1.4_all.deb
Checksums-Sha256:
5ff97a7dcdca2d274ff753f4ae2f102c5e85352b0ca6d4ab2c739ca9dac4c2a6 1013
netdisco-mibs-installer_1.4.dsc
aec4a513a481e175e1adaf1fde035a3472d5446693434783068cf7612888aa16 6441
netdisco-mibs-installer_1.4.tar.gz
094f54b4b70e25ad4d0c3a6476d9ec113b9ace39bd24a1953f7d1a9a5f131be5 12780
netdisco-mibs-installer_1.4_all.deb
Files:
ef20df703484e54f7daa60647233ce2a 1013 contrib/net extra
netdisco-mibs-installer_1.4.dsc
2ddee91062c5c433b46b14ccef001fd7 6441 contrib/net extra
netdisco-mibs-installer_1.4.tar.gz
0b64a2151bbbc6514738ca21b2024e46 12780 contrib/net extra
netdisco-mibs-installer_1.4_all.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
iEYEAREDAAYFAktKYGoACgkQgeVih7XOVJd8EwCeILi4t3bvzCjGSR0dq+G+XLOc
VPgAniTq+TfCxm6PtAXX7nO5W2VjuGZz
=iaRD
-----END PGP SIGNATURE-----
--- End Message ---
