Bug#766147: [php-maint] Bug#766147: php5-common: session cleanup can be misused to change modification time of arbitrary files to "now" when symlink protection not enabled

2014-11-19 Thread Bernard Massot
Le 21/10/2014 à 12:06, Ondřej Surý a écrit : > This change will be included in next wheezy update of PHP. Debian Wheezy has Sed 4.2.1, whereas "-z" option was added in Sed 4.2.2. As a consequence /usr/lib/php5/sessionclean is broken on Debian Stable! Please fix. -- Bernard Massot -- To UNSUBSC

Bug#766147: [php-maint] Bug#766147: php5-common: session cleanup can be misused to change modification time of arbitrary files to "now" when symlink protection not enabled

2014-10-22 Thread Fiedler Roman
> Von: Ondřej Surý [mailto:ond...@sury.org] > > This should then fix even your case... > > [ -x /usr/bin/lsof ] && /usr/bin/lsof -w -l +d "/var/lib/php5" -F0 | sed > -zne "s/^n//p" | xargs -0i echo touch -c -h "'{}'" > > touch -c -h '/var/lib/php5/xxx\' > touch -c -h 'n/var/lib/php5/passwd' Loo

Bug#766147: [php-maint] Bug#766147: php5-common: session cleanup can be misused to change modification time of arbitrary files to "now" when symlink protection not enabled

2014-10-22 Thread Ondřej Surý
This should then fix even your case... [ -x /usr/bin/lsof ] && /usr/bin/lsof -w -l +d "/var/lib/php5" -F0 | sed -zne "s/^n//p" | xargs -0i echo touch -c -h "'{}'" touch -c -h '/var/lib/php5/xxx\' touch -c -h 'n/var/lib/php5/passwd' Right? Cheers, Ondrej On Wed, Oct 22, 2014, at 15:14, Fiedler

Bug#766147: [php-maint] Bug#766147: php5-common: session cleanup can be misused to change modification time of arbitrary files to "now" when symlink protection not enabled

2014-10-22 Thread Ondřej Surý
On Wed, Oct 22, 2014, at 15:14, Fiedler Roman wrote: > To proof this, I would have to prepare a machine with sid (unless you > have one ready with remote SSH for testing) You don't really need a sid machine, just copy the script from the package. Cheers, -- Ondřej Surý Knot DNS (https://www.kno

Bug#766147: [php-maint] Bug#766147: php5-common: session cleanup can be misused to change modification time of arbitrary files to "now" when symlink protection not enabled

2014-10-22 Thread Fiedler Roman
> Von: Ondřej Surý [mailto:ond...@sury.org] > > Control: tags -1 +pending > > On Tue, Oct 21, 2014, at 11:33, Ondřej Surý wrote: > > On Tue, Oct 21, 2014, at 11:16, Fiedler Roman wrote: > > > > Von: Ondřej Surý [mailto:ond...@sury.org] > > > > > > > > On Tue, Oct 21, 2014, at 10:55, Fiedler Roman

Bug#766147: [php-maint] Bug#766147: php5-common: session cleanup can be misused to change modification time of arbitrary files to "now" when symlink protection not enabled

2014-10-21 Thread Ondřej Surý
Control: tags -1 +pending On Tue, Oct 21, 2014, at 11:33, Ondřej Surý wrote: > On Tue, Oct 21, 2014, at 11:16, Fiedler Roman wrote: > > > Von: Ondřej Surý [mailto:ond...@sury.org] > > > > > > On Tue, Oct 21, 2014, at 10:55, Fiedler Roman wrote: > > > > > Von: Ondřej Surý [mailto:ond...@sury.org]

Bug#766147: [php-maint] Bug#766147: php5-common: session cleanup can be misused to change modification time of arbitrary files to "now" when symlink protection not enabled

2014-10-21 Thread Ondřej Surý
On Tue, Oct 21, 2014, at 11:16, Fiedler Roman wrote: > > Von: Ondřej Surý [mailto:ond...@sury.org] > > > > On Tue, Oct 21, 2014, at 10:55, Fiedler Roman wrote: > > > > Von: Ondřej Surý [mailto:ond...@sury.org] > > > > > > > > Hi, > > > > > > > > TL;DR: "s/touch -c/touch -c -h/", right? > > > > > >

Bug#766147: [php-maint] Bug#766147: php5-common: session cleanup can be misused to change modification time of arbitrary files to "now" when symlink protection not enabled

2014-10-21 Thread Ondřej Surý
On Tue, Oct 21, 2014, at 10:55, Fiedler Roman wrote: > > Von: Ondřej Surý [mailto:ond...@sury.org] > > > > Hi, > > > > TL;DR: "s/touch -c/touch -c -h/", right? > > This will fix it for arbitrary symlinks, the only remaining issues would > be > > a) keeping open a file ".. ", which will upda

Bug#766147: [php-maint] Bug#766147: php5-common: session cleanup can be misused to change modification time of arbitrary files to "now" when symlink protection not enabled

2014-10-21 Thread Ondřej Surý
Hi, TL;DR: "s/touch -c/touch -c -h/", right? Cheers, Ondrej On Tue, Oct 21, 2014, at 09:52, Fiedler Roman wrote: > Package: php5-common > Version: 5.4.4-14+deb7u14 > Tags: security > > /usr/lib/php5/sessionclean from [1] enables any process allowed to create > entries in /var/lib/php5 to adjus