5354283 2000-08-12 05:57 /50 rader/ Brevbäraren (som är implementerad i) Python Mottagare: Bugtraq (import) <12190> Ärende: CONECTIVA LINUX SECURITY ANNOUNCEMENT - diskcheck ------------------------------------------------------------ From: secure@CONECTIVA.COM.BR To: BUGTRAQ@SECURITYFOCUS.COM Message-ID: <20000810163547.E9845@conectiva.com.br> ---------------------------------------------------------------------- CONECTIVA LINUX SECURITY ANNOUNCEMENT ---------------------------------------------------------------------- PACKAGE : diskcheck SUMMARY : Insecure file creation in /tmp DATE : 2000-08-10 AFFECTED CONECTIVA VERSIONS : 5.0, 5.1, e-commerce and graphic tools DESCRIPTION The diskcheck package includes a perl script which checks for available disk space. It is run as root by cron every hour. This script creates a file in /tmp in an insecure manner, allowing an attacker to use symlink attacks to write anywhere in the system. SOLUTION All users should upgrade immediately. This new package no longer creates temporary files. DIRECT DOWNLOAD LINKS TO UPDATED PACKAGES ftp://ftp.conectiva.com.br/pub/conectiva/atualizacoes/5.0/noarch/diskcheck-3.1.1-3cl.noarch.rpm ftp://ftp.conectiva.com.br/pub/conectiva/atualizacoes/5.1/noarch/diskcheck-3.1.1-3cl.noarch.rpm ftp://ftp.conectiva.com.br/pub/conectiva/atualizacoes/ferramentas/ecommerce/noarch/diskcheck-3.1.1-3cl.noarch.rpm ftp://ftp.conectiva.com.br/pub/conectiva/atualizacoes/ferramentas/graficas/noarch/diskcheck-3.1.1-3cl.noarch.rpm DIRECT LINK TO THE SOURCE PACKAGES ftp://ftp.conectiva.com.br/pub/conectiva/atualizacoes/5.0/SRPMS/diskcheck-3.1.1-3cl.src.rpm ftp://ftp.conectiva.com.br/pub/conectiva/atualizacoes/5.1/SRPMS/diskcheck-3.1.1-3cl.src.rpm ftp://ftp.conectiva.com.br/pub/conectiva/atualizacoes/ferramentas/ecommerce/SRPMS/diskcheck-3.1.1-3cl.src.rpm ftp://ftp.conectiva.com.br/pub/conectiva/atualizacoes/ferramentas/graficas/SRPMS/diskcheck-3.1.1-3cl.src.rpm ---------------------------------------------------------------------- All packages are signed with Conectiva's GPG key. The key can be obtained at http://www.conectiva.com.br/contato ---------------------------------------------------------------------- subscribe: atualizacoes-anuncio-subscribe@bazar.conectiva.com.br unsubscribe: atualizacoes-anuncio-unsubscribe@bazar.conectiva.com.br (5354283) ------------------------------------------(Ombruten)