Your message dated Sun, 21 Aug 2011 23:32:40 +0000
with message-id <[email protected]>
and subject line Bug#631912: fixed in pyro 1:3.14-1
has caused the Debian Bug report #631912,
regarding pyro: pidfile in /tmp, opened insecurely [CVE-2011-2765]
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
631912: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=631912
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: pyro
Version: 3.9.1-1
Severity: grave
Tags: security
Justification: user security hole
class Daemonizer:
[...]
def __init__(self, pidfile=None):
if not pidfile:
self.pidfile = "/tmp/%s.pid" % self.__class__.__name__.lower()
else:
self.pidfile = pidfile
[...]
def daemon_start(self, start_as_daemon=1):
if start_as_daemon:
self.become_daemon()
if self.is_process_running():
msg = "Unable to start server. Process is already running."
raise DaemonizerException(msg)
f = open(self.pidfile, 'w')
f.write("%s" % os.getpid())
f.close()
self.main_loop()
and:
class NSD(Daemonizer):
def __init__(self):
Daemonizer.__init__(self)
def main_loop(self):
Pyro.naming.main(sys.argv[1:])
if __name__ == "__main__":
NSD().process_command_line(sys.argv)
results in root opening /tmp/nsd.pid on startup.
Cheers,
Julien
-- System Information:
Debian Release: 6.0.2
APT prefers stable
APT policy: (500, 'stable')
Architecture: amd64 (x86_64)
Kernel: Linux 2.6.32-5-amd64 (SMP w/8 CPU cores)
Locale: LANG=C, LC_CTYPE=fr_FR.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Versions of packages pyro depends on:
ii python 2.6.6-3+squeeze6 interactive high-level object-orie
ii python-support 1.0.10 automated rebuilding support for P
pyro recommends no packages.
Versions of packages pyro suggests:
pn pyro-doc <none> (no description available)
pn pyro-gui <none> (no description available)
-- no debconf information
--- End Message ---
--- Begin Message ---
Source: pyro
Source-Version: 1:3.14-1
We believe that the bug you reported is fixed in the latest version of
pyro, which is due to be installed in the Debian FTP archive:
pyro-doc_3.14-1_all.deb
to main/p/pyro/pyro-doc_3.14-1_all.deb
pyro-examples_3.14-1_all.deb
to main/p/pyro/pyro-examples_3.14-1_all.deb
pyro-gui_3.14-1_all.deb
to main/p/pyro/pyro-gui_3.14-1_all.deb
pyro_3.14-1.debian.tar.gz
to main/p/pyro/pyro_3.14-1.debian.tar.gz
pyro_3.14-1.dsc
to main/p/pyro/pyro_3.14-1.dsc
pyro_3.14-1_all.deb
to main/p/pyro/pyro_3.14-1_all.deb
pyro_3.14.orig.tar.gz
to main/p/pyro/pyro_3.14.orig.tar.gz
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Gustavo Goretkin <[email protected]> (supplier of updated pyro package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Format: 1.8
Date: Sun, 21 Aug 2011 16:04:00 -0400
Source: pyro
Binary: pyro pyro-gui pyro-doc pyro-examples
Architecture: source all
Version: 1:3.14-1
Distribution: unstable
Urgency: high
Maintainer: Debian Python Modules Team
<[email protected]>
Changed-By: Gustavo Goretkin <[email protected]>
Description:
pyro - distributed object system for Python
pyro-doc - documentation for Pyro
pyro-examples - examples for Pyro
pyro-gui - graphicals tool for Pyro
Closes: 631912
Changes:
pyro (1:3.14-1) unstable; urgency=high
.
* New upstream release
- /usr/bin/pyro-rns was removed by upstream
* SECURITY UPDATE: arbitrary file overwriting via symlink (Closes: #631912,
LP: #830742)
- store pidfile in /var/run instead of /tmp
- Pyro/ext/daemonizer.py changed default location to /var/run
- Pyro/ext/daemonizer.py added command-line parameter (--pidfile=...) to
override default pidfile location
- default location for pidfile is tunable via /etc/default/pyro-nsd
- CVE-2011-2765
Checksums-Sha1:
a7669fa3bc2fa79c77cfe586bf6032960cfb2ff3 2022 pyro_3.14-1.dsc
7d065111866cc75a4196d412a85ca6d51ae63733 296905 pyro_3.14.orig.tar.gz
4268828d2cf530713d243da5e0f2e0253acce7e0 9325 pyro_3.14-1.debian.tar.gz
62bae7d91c68d9fec8e83e0af7fd0539ee7addaa 72992 pyro_3.14-1_all.deb
5fbae5502d314de78ffbb1665c51ef76f2d1066a 16140 pyro-gui_3.14-1_all.deb
4a88b698666e022a360f42fdb6e8bb5f8e654630 147406 pyro-doc_3.14-1_all.deb
63d381d486cbd8824cd20aa2850c654ac3e8b1ed 108356 pyro-examples_3.14-1_all.deb
Checksums-Sha256:
930cd8fae7bf41b755bbe02d41b6eb4b9405346786c526ac817e1793becceca1 2022
pyro_3.14-1.dsc
f01e32f8d1c3f427c4916e13d9e8cee24dbf924f72922a06591515911bd13756 296905
pyro_3.14.orig.tar.gz
c2791b1166b1b4e81a1a5d28035590bbb7b5a22f04e5dbe02118ad4dd43f940e 9325
pyro_3.14-1.debian.tar.gz
42d33ff0fa7e20cd5993e2d14e1976c192f1e7b4fe8a2651da65e30452e10cb0 72992
pyro_3.14-1_all.deb
dec56ec578e697a3f3751a1c490a8ca47b6e080ac991c72522ae3af9d1db34b2 16140
pyro-gui_3.14-1_all.deb
b504da1d1a5f2bf48690ec6c7827fa661d05bf52b0e74a32146a0886d2980050 147406
pyro-doc_3.14-1_all.deb
ca6f0b7cec16eeea2b495c3fb5da4a46ccf52d2cc50af21275093f304393a2b7 108356
pyro-examples_3.14-1_all.deb
Files:
49f4901cb6b206611a2c1cc85fb52b90 2022 python optional pyro_3.14-1.dsc
2101230425e6c76f5aa2e9d5167cbd3b 296905 python optional pyro_3.14.orig.tar.gz
4217331c39eb1d2d7769f2315a22db33 9325 python optional pyro_3.14-1.debian.tar.gz
45aaba51c5a46a4e9b0d174860d26fc5 72992 python optional pyro_3.14-1_all.deb
b7f67ef0fd7a6abdfbd09303abe53df4 16140 python optional pyro-gui_3.14-1_all.deb
04fede18d3edbfe0521f4404389e2c49 147406 doc optional pyro-doc_3.14-1_all.deb
4ae963a28128b437fd655028c19558dd 108356 python optional
pyro-examples_3.14-1_all.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
iQIcBAEBCAAGBQJOUZNCAAoJEPGmm+QpwP/utIcP/jMhLYj3PY/h/5/a2EdseOiG
r/Ag+KZdamo3p89yI6yah+BCmUFykrhlB1E3MX6eDoE8jx4eyneXPgASrX2mzNtq
+kOLDpwpf2gXcdRWjjd5TAGW4eRoCGFoSaRH47AyMEbPpzpcckBSi6AUEP/5+URY
wrGnI1iwFSRVTS2kDUp5owA/VnyGv0fU6EY4bfDckuX1a2NyBwb9qSz/dtYkbR01
WNRkbJ6M2hr0JKdRqkagWHpVbyW0VXHxHeffUy6uiw/xoXlJVA4tqAceYeA36Ds1
Kif9wBKfIZtLQ9PL2iOEWvnVX2FbF3gr/JnEG4E4o6D9nAQadgbOVrEIgTVrsvYC
Dx+CAfULg9vT+hM2gzSDmH9xNXEOS4pP7ngxBD+hTdlBuZZy/sYRiRWPFcp7r/0K
8tYQrJApKX0iADZZoIBlI+2OX2fVDXq3DDhR6yh6pkz0DfN/ssgKYjMfuuset1sk
sQwKgSz7zadPG/3EYhPThauqZHBX1A2qmLqPhsmP+LQmX0zWnjuyaAvkB3F29RLK
e6j6rLRIQhXDar7NV/fj4/M0XeS+EQPusrONyG6jL273pkbebI1JPt5a7K5ihRPi
E1Esu9QoZspBowdRmqHlBNo5eR3pbeHIy9cN4280VgZxfhp5s8Eb5mrtMBUdBwX6
wEkqnpYFUfa0daaPV8Qe
=bXBI
-----END PGP SIGNATURE-----
--- End Message ---
_______________________________________________
Python-modules-team mailing list
[email protected]
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/python-modules-team
