Security issue in PackageKit

[Matthias Klumpp]

Hi!
The Aptcc backend in PackageKit saves the changelog to a predictable location in /tmp. As packagekitd is running as root, bad people could just add a symlink named like the file in /tmp (e.g. to /etc/shadow) to screw up the system.
I fixed this in Debian already, you might want to take the patch (02_aptcc-changelog-random-dir.patch) from there and apply it to Precise, if possible.
For Quantal, please merge/sync packagekit 0.7.4-4 from Debian Sid, which contains the patch and some other improvements.
Cheers,
   Matthias

UPDATE: The same also applies for our Debconf handling. While the changelog-issue is fixed, this issue is still valid for debconf sockets.
I therefore reopened this bug on Quantal and linked the Debian issue, which will be fixed soon.

[Jamie Strandboge (jdstrand)]

Thanks for your report!

Ubuntu has symlink restrictions enabled via Yama which should mitigate this problem on Ubuntu 11.04 and later (but we should still fix it). I see Quantal already has 0.7.4-4ubuntu2. Did Debian assign a CVE for it?

[Jamie Strandboge (jdstrand)]

Since this is already public via the Debian upload, marking this public.

[Matthias Klumpp (ximion)]

No, there is no CVE yet - I don't know how to create one :P
This issue is unfortunately also present in our implementation of Debconf and will also need to be fixed there. (work is in progress)
Thanks!

[Matthias Klumpp (ximion)]

Depends on someone fixing bug #1040086 (Sync packagekit from Debian) now.

[Jamie Strandboge (jdstrand)]

Thank you for reporting this bug to Ubuntu. natty has reached EOL
(End of Life) and is no longer supported. As a result, this bug
against natty is being marked "Won't Fix". Please see
https://wiki.ubuntu.com/Releases for currently supported Ubuntu
releases.

Please feel free to report any other bugs you may find.

[Jamie Strandboge (jdstrand)]

Thank you for reporting this bug to Ubuntu. oneiric has reached EOL
(End of Life) and is no longer supported. As a result, this bug
against oneiric is being marked "Won't Fix". Please see
https://wiki.ubuntu.com/Releases for currently supported Ubuntu
releases.

Please feel free to report any other bugs you may find.

[Rolf Leggewie (r0lf)]

lucid has seen the end of its life and is no longer receiving any updates. Marking the lucid task for this ticket as "Won't Fix".

[Steve Langasek (vorlon)]

The Precise Pangolin has reached end of life, so this bug will not be fixed for that release