Ubuntu
gource package

Gource uses a predictable temporary filename

Bug #564373 reported by Andrew Caudwell on 2010-04-16

260

This bug affects 1 person

Affects		Status	Importance	Assigned to	Milestone
	gource (Debian)	Fix Released	Unknown	debbugs #577958
	gource (Ubuntu)	Fix Released	Medium	Unassigned

Bug Description

Binary package hint: gource

Gource uses a predictable temporary filename /tmp/gource-$UID.tmp (src/commitlog.cpp: createTempLog()), enabling a malicious co-user to overwrite an arbitrary file via a symlink attack.

Affects 0.23 in Lucid.

Originally report against 0.26 in Debian Squeeze:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=577958

I am preparing a security update patch.

Related branches

lp:ubuntu/lucid-security/gource

Andrew Caudwell (acaudwell) on 2010-04-16

visibility:

private → public

Revision history for this message

Andrew Caudwell (acaudwell) wrote on 2010-04-16:

gource_564373.patch Edit (1.9 KiB, text/plain)

This patch changes createTempLog() in src/commitlog.cpp to create the temp file using mkstemp().

Bug Watch Updater (bug-watch-updater) on 2010-04-16

Changed in gource (Debian):
status:	Unknown → Fix Released

Marc Deslauriers (mdeslaur) on 2010-04-20

Changed in gource (Ubuntu):
status:	New → Confirmed
importance:	Undecided → Medium

Revision history for this message

Marc Deslauriers (mdeslaur) wrote on 2010-04-30:

Thanks for the debdiff, Andrew!

ACK'd

I'll upload it today, and will publish it on monday.

Marc Deslauriers (mdeslaur) on 2010-04-30

Changed in gource (Ubuntu):
status:	Confirmed → Fix Committed

Revision history for this message

Launchpad Janitor (janitor) wrote on 2010-05-06:

This bug was fixed in the package gource - 0.23-1ubuntu0.1

---------------
gource (0.23-1ubuntu0.1) lucid-security; urgency=high

  * SECURITY UPDATE: Gource uses a predictable temporary filename,
    enabling a malicious co-user to overwrite an arbitrary file via a
    symlink attack. (LP: #564373)
    - src/commitlog.cpp: changed createTempLog() to create the temp file
      using mkstemp().
-- Andrew Caudwell <email address hidden> Fri, 16 Apr 2010 13:54:44 +1200