[16213] in bugtraq
CONECTIVA LINUX SECURITY ANNOUNCEMENT - diskcheck
daemon@ATHENA.MIT.EDU (secure@CONECTIVA.COM.BR)
Sat Aug 12 01:46:45 2000
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Message-Id: <20000810163547.E9845@conectiva.com.br>
Date: Thu, 10 Aug 2000 16:35:47 -0300
Reply-To: secure@CONECTIVA.COM.BR
From: secure@CONECTIVA.COM.BR
X-To: lwn@lwn.net, sergio@bruder.net, brain@matrix.com.br,
security-alert@linuxsecurity.com
To: BUGTRAQ@SECURITYFOCUS.COM
----------------------------------------------------------------------
CONECTIVA LINUX SECURITY ANNOUNCEMENT
----------------------------------------------------------------------
PACKAGE : diskcheck
SUMMARY : Insecure file creation in /tmp
DATE : 2000-08-10
AFFECTED CONECTIVA VERSIONS : 5.0, 5.1, e-commerce and graphic tools
DESCRIPTION
The diskcheck package includes a perl script which checks for available
disk space. It is run as root by cron every hour.
This script creates a file in /tmp in an insecure manner, allowing an
attacker to use symlink attacks to write anywhere in the system.
SOLUTION
All users should upgrade immediately. This new package no longer
creates temporary files.
DIRECT DOWNLOAD LINKS TO UPDATED PACKAGES
ftp://ftp.conectiva.com.br/pub/conectiva/atualizacoes/5.0/noarch/diskcheck-3.1.1-3cl.noarch.rpm
ftp://ftp.conectiva.com.br/pub/conectiva/atualizacoes/5.1/noarch/diskcheck-3.1.1-3cl.noarch.rpm
ftp://ftp.conectiva.com.br/pub/conectiva/atualizacoes/ferramentas/ecommerce/noarch/diskcheck-3.1.1-3cl.noarch.rpm
ftp://ftp.conectiva.com.br/pub/conectiva/atualizacoes/ferramentas/graficas/noarch/diskcheck-3.1.1-3cl.noarch.rpm
DIRECT LINK TO THE SOURCE PACKAGES
ftp://ftp.conectiva.com.br/pub/conectiva/atualizacoes/5.0/SRPMS/diskcheck-3.1.1-3cl.src.rpm
ftp://ftp.conectiva.com.br/pub/conectiva/atualizacoes/5.1/SRPMS/diskcheck-3.1.1-3cl.src.rpm
ftp://ftp.conectiva.com.br/pub/conectiva/atualizacoes/ferramentas/ecommerce/SRPMS/diskcheck-3.1.1-3cl.src.rpm
ftp://ftp.conectiva.com.br/pub/conectiva/atualizacoes/ferramentas/graficas/SRPMS/diskcheck-3.1.1-3cl.src.rpm
----------------------------------------------------------------------
All packages are signed with Conectiva's GPG key. The key can be obtained at
http://www.conectiva.com.br/contato
----------------------------------------------------------------------
subscribe: atualizacoes-anuncio-subscribe@bazar.conectiva.com.br
unsubscribe: atualizacoes-anuncio-unsubscribe@bazar.conectiva.com.br
