It appears that git commit 7335eebea6dd43581d4650a8818b06383ab89901 introduced the bug, i.e. the fchmod() call there. This was done in Tue Aug 27 2013. Ironically it was meant to improve the security of apt by replacing mktemp() with mkostemp() - oh well. No stable version of ubuntu is affected (and none for Debian) - the change was introduced in apt 0.9.11.2.
The issue is caused by the confusingly named paramter "Perm" in FileFd::Open() which is not actually the Permission bits but the mode bits of open(). So 666 means something entirely different here in fchmod() than in open(). -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1304657 Title: world writable files in /var/lib/apt/lists To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1304657/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
