Bug #12030 “vim: Race conditions and symlink attacks in vim (tcl...” : Bugs : vim package : Debian

Revision history for this message

In Debian Bug tracker #289560, Javier Fernández-Sanguino (jfs) wrote on 2005-01-09:

#1

On Sun, Jan 09, 2005 at 10:02:35PM +0100, Bram Moolenaar wrote:
>
> Javier -
>
> > Reviewing vim as part of the security audit the Audit team [1] is
> > conducting I've found what I believe are some race conditions and symlink
> > attacks through temporary files in vim. They appear in two scripts which
> > are not installed in Debian in binary locations (they are installed under
> > /usr/share/doc/vim/tools/) but are provided with execute permissions.
>
> Thanks for looking into this and providing patches.
>
> Did you contact the original authors, Darren Hiebert and Neil
> Schemenauer?

No, I didn't. I was not sure if they were still active. Do you want me to
forward this?

> I wonder if there isn't a shorter method. The handling of the temp file
> becomes more than half the script this way.

Actually, there is, you could remove the lines that try to use a temporary
file in a temporary directory (below the comments) and just abort with a
"Cannot create temporary file" message if tmp_tagfile (or OUTFILE) are
'none'.

Regards

Javier

Revision history for this message

In Debian Bug tracker #289560, Bram Moolenaar (bram-moolenaar) wrote on 2005-01-10:

#2

Javier -

> > Did you contact the original authors, Darren Hiebert and Neil
> > Schemenauer?
>
> No, I didn't. I was not sure if they were still active. Do you want me to
> forward this?

Yes. They are the authors, thus I hesitate to change their work without
at least trying to contact them.

> > I wonder if there isn't a shorter method. The handling of the temp file
> > becomes more than half the script this way.
>
> Actually, there is, you could remove the lines that try to use a temporary
> file in a temporary directory (below the comments) and just abort with a
> "Cannot create temporary file" message if tmp_tagfile (or OUTFILE) are
> 'none'.

So there would be a few (old?) systems where the script won't work?

--
GALAHAD: No. Look, I can tackle this lot single-handed!
GIRLS: Yes, yes, let him Tackle us single-handed!
"Monty Python and the Holy Grail" PYTHON (MONTY) PICTURES LTD

/// Bram Moolenaar -- <email address hidden> -- http://www.Moolenaar.net \\\
/// Sponsor Vim, vote for features -- http://www.Vim.org/sponsor/ \\\
\\\ Project leader for A-A-P -- http://www.A-A-P.org ///
\\\ Buy LOTR 3 and help AIDS victims -- http://ICCF.nl/lotr.html ///

Revision history for this message

In Debian Bug tracker #289560, Javier Fernández-Sanguino (jfs) wrote on 2005-01-10:

#3

On Mon, Jan 10, 2005 at 10:33:00AM +0100, Bram Moolenaar wrote:
> > > Did you contact the original authors, Darren Hiebert and Neil
> > > Schemenauer?
> >
> > No, I didn't. I was not sure if they were still active. Do you want me to
> > forward this?
>
> Yes. They are the authors, thus I hesitate to change their work without
> at least trying to contact them.

Ok. Will do.

>
> > > I wonder if there isn't a shorter method. The handling of the temp file
> > > becomes more than half the script this way.
> >
> > Actually, there is, you could remove the lines that try to use a temporary
> > file in a temporary directory (below the comments) and just abort with a
> > "Cannot create temporary file" message if tmp_tagfile (or OUTFILE) are
> > 'none'.
>
> So there would be a few (old?) systems where the script won't work?

Correct. Those that don't have mktemp or tempfile. These should be
available in most Linux distributions but I'm not sure about their
availability in other UNIX systems (I believe mktemp is available in
Solaris, in HP-UX and in Tru64 but not in AIX, for example)

Regards

Javier

Revision history for this message

In Debian Bug tracker #289560, Javier Fernández-Sanguino (jfs) wrote on 2005-01-10:

#4

On Mon, Jan 10, 2005 at 10:33:00AM +0100, Bram Moolenaar wrote:
>
> Javier -
>
> > > Did you contact the original authors, Darren Hiebert and Neil
> > > Schemenauer?
> >
> > No, I didn't. I was not sure if they were still active. Do you want me to
> > forward this?
>
> Yes. They are the authors, thus I hesitate to change their work without
> at least trying to contact them.

At least one of the mail addresses (<email address hidden>) bounces.

Regards

Javier

Revision history for this message

In Debian Bug tracker #289560, Javier Fernández-Sanguino (jfs) wrote on 2005-01-10:

#5

On Mon, Jan 10, 2005 at 11:01:57AM +0100, Javier Fernández-Sanguino Peña wrote:
> At least one of the mail addresses (<email address hidden>) bounces.

The other author address (<email address hidden>) bounces too.

Regards

Javier

Revision history for this message

In Debian Bug tracker #289560, Mark J Cox (mjc-redhat) wrote on 2005-01-14: [coley@mitre.org: Re: CVE request] (fwd

#6

This is CAN-2005-0069.

Revision history for this message

In Debian Bug tracker #289560, Martin Schulze (joey-infodrom) wrote on 2005-01-14: cve id

#7

Please use CAN-2005-0069.

Regards,

Joey

--
The MS-DOS filesystem is nice for removable media. -- H. Peter Anvin

Please always Cc to me when replying to me on the lists.

Revision history for this message

In Debian Bug tracker #289560, Norbert Tretkowski (tretkowski) wrote on 2005-01-15: tags

#8

tags 289560 +pending
thanks

Norbert

Revision history for this message

In Debian Bug tracker #289560, Norbert Tretkowski (tretkowski) wrote on 2005-01-18: Re: Bug#291125: vim: temporary file vulnerabilities (CAN-2005-0069)

#9

severity 289560 grave
merge 289560 291125
thanks

* Joey Hess wrote:
> As described in the Ubuntu advisory below, vim's tcltags and vimspell
> scripts use temp files insecurely.

Updated package is already building currently.

Norbert

Revision history for this message

Debian Bug Importer (debzilla) wrote on 2005-01-18:

#10

Automatically imported from Debian bug report #289560 http://bugs.debian.org/289560

Revision history for this message

Debian Bug Importer (debzilla) wrote on 2005-01-18:

#11

Download full text (5.6 KiB)

Message-ID: <email address hidden>
Date: Sun, 9 Jan 2005 21:05:26 +0100
From: Javier =?iso-8859-1?Q?Fern=E1ndez-Sanguino_Pe=F1a?= <email address hidden>
To: <email address hidden>
Cc: Bram Moolenaar <email address hidden>
Subject: vim: Race conditions and symlink attacks in vim (tcltags and vimspell)

--2B/JsCI69OhZNC5r
Content-Type: multipart/mixed; boundary="AhhlLboLdkugWU4S"
Content-Disposition: inline

--AhhlLboLdkugWU4S
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Package: vim
Version: 1:6.3-046+1
Severity: minor
Tags: patch security sid woody sarge

Hi there,

Reviewing vim as part of the security audit the Audit team [1] is=20
conducting I've found what I believe are some race conditions and symlink=
=20
attacks through temporary files in vim. They appear in two scripts which=20
are not installed in Debian in binary locations (they are installed under
/usr/share/doc/vim/tools/) but are provided with execute permissions.

That's mainly why I'm opening this bug up in Debian's BTS and not=20
contacting the security team directly although the code is present in all=
=20
vim releases in Debian.

These appear in:

1.- the tcltags script (runtime/tools/tcltags):
    (...)
    11 tmp_tagfile=3D/tmp/${program_name}.$$
    (...)
    130 sed -e "/^!_TAG_FILE_SORTED/s/ [01] / $sorted /"=
=20
\
    131 -e "/^!_TAG_FILE_FORMAT/s/ 1 / $format /"=
=20
\
    132 $tagfile > $tmp_tagfile

2.- the vimspell script (runtime/tools/vimspell.sh)

     16 OUTFILE=3D/tmp/vimspell.$$
     17 # if you have "tempfile", use the following line
     18 #OUTFILE=3D`tempfile`
(...)
     30 spell $SPELL_ARGS $INFILE | sort -u |
     31 awk '
     32 {
     33 printf "syntax match SpellErrors \"\\<%s\\>\"\n", $0 ;
     34 }
     35
     36 END {
     37 printf "highlight link SpellErrors ErrorMsg\n\n" ;
     38 }
     39 ' > $OUTFILE
     40 echo "!rm $OUTFILE" >> $OUTFILE
     41 echo $OUTFILE

Since these are tools that are run from vim, an attacker can get a=20
good-enough approximation of the PIDs that will be used in these temporary=
=20
files and can conduct a symlink attack if these tools are used.

The attached patch should fix both of these issues, I've taken the=20
approach implemented in vimtutor, but modified it slightly for vimspell as=
=20
the temporary file cannot be removed by the script (vim removes it) when=20
mktemp and tempfile are not avilable, there will still be a race condition=
=20
in the script. Since most GNU/Linux and UNIX operating systems seem to=20
have either one I don't think it's a big issue, however.

Best regards

Javier

--AhhlLboLdkugWU4S
Content-Type: text/plain; charset=us-ascii
Content-Disposition: attachment; filename="vim-6.3.diff"
Content-Transfer-Encoding: quoted-printable

diff -Nru vim-6.3.old/vim63/runtime/tools/tcltags vim-6.3/vim63/runtime/too=
ls/tcltags
--- vim-6.3.old/vim63/runtime/tools/tcltags 1999-08-01 14:01:46.000000000 +=
0200
+++ vim-6.3/vim63/runtime/tools/tcltags 2005-01-09 20:41:41.000000000 +0100
@@ -8,7 +8,31 @@
program_version=3D"0.3"
pr...

Message-ID: <20050109200526.GA2889@dat.etsit.upm.es>
Date: Sun, 9 Jan 2005 21:05:26 +0100
From: Javier =?iso-8859-1?Q?Fern=E1ndez-Sanguino_Pe=F1a?= <jfs@computer.org>
To: submit@bugs.debian.org
Cc: Bram Moolenaar <Bram@vim.org>
Subject: vim: Race conditions and symlink attacks in vim (tcltags and vimspell)

--2B/JsCI69OhZNC5r
Content-Type: multipart/mixed; boundary="AhhlLboLdkugWU4S"
Content-Disposition: inline

--AhhlLboLdkugWU4S
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Package: vim
Version: 1:6.3-046+1
Severity: minor
Tags: patch security sid woody sarge

Hi there,

Reviewing vim as part of the security audit the Audit team [1] is=20
conducting I've found what I believe are some race conditions and symlink=
=20
attacks through temporary files in vim. They appear in two scripts which=20
are not installed in Debian in binary locations (they are installed under
/usr/share/doc/vim/tools/) but are provided with execute permissions.

That's mainly why I'm opening this bug up in Debian's BTS and not=20
contacting the security team directly although the code is present in all=
=20
vim releases in Debian.

These appear in:

1.- the tcltags script (runtime/tools/tcltags):
    (...)
    11 tmp_tagfile=3D/tmp/${program_name}.$$
    (...)
    130         sed -e "/^!_TAG_FILE_SORTED/s/  [01]    /       $sorted /"=
=20
\
    131             -e "/^!_TAG_FILE_FORMAT/s/  1       /       $format /"=
=20
\
    132             $tagfile > $tmp_tagfile

2.- the vimspell script (runtime/tools/vimspell.sh)

16 OUTFILE=3D/tmp/vimspell.$$
     17 # if you have "tempfile", use the following line
     18 #OUTFILE=3D`tempfile`
(...)
     30 spell $SPELL_ARGS $INFILE | sort -u |
     31 awk '
     32       {
     33         printf "syntax match SpellErrors \"\\<%s\\>\"\n", $0 ;
     34       }
     35
     36 END   {
     37         printf "highlight link SpellErrors ErrorMsg\n\n" ;
     38       }
     39 ' > $OUTFILE
     40 echo "!rm $OUTFILE" >> $OUTFILE
     41 echo $OUTFILE

Since these are tools that are run from vim, an attacker can get a=20
good-enough approximation of the PIDs that will be used in these temporary=
=20
files and can conduct a symlink attack if these tools are used.

The attached patch should fix both of these issues, I've taken the=20
approach implemented in vimtutor, but modified it slightly for vimspell as=
=20
the temporary file cannot be removed by the script (vim removes it) when=20
mktemp and tempfile are not avilable, there will still be a race condition=
=20
in the script. Since most GNU/Linux and UNIX  operating systems seem to=20
have either one I don't think it's a big issue, however.

Best regards

Javier

--AhhlLboLdkugWU4S
Content-Type: text/plain; charset=us-ascii
Content-Disposition: attachment; filename="vim-6.3.diff"
Content-Transfer-Encoding: quoted-printable

diff -Nru vim-6.3.old/vim63/runtime/tools/tcltags vim-6.3/vim63/runtime/too=
ls/tcltags
--- vim-6.3.old/vim63/runtime/tools/tcltags	1999-08-01 14:01:46.000000000 +=
0200
+++ vim-6.3/vim63/runtime/tools/tcltags	2005-01-09 20:41:41.000000000 +0100
@@ -8,7 +8,31 @@
 program_version=3D"0.3"
 program_author=3D"Darren Hiebert"
 author_email=3D"darren@hiebert.com"
-tmp_tagfile=3D/tmp/${program_name}.$$
+tmp=3D"${TMPDIR-/tmp}"
+tmp_tagfile=3D`mktemp -t $tmp/tcltagXXXXXX || tempfile -p tclag || echo no=
ne`
+
+# If the standard commands failed then create a directory to put the copy =
in.
+# That is a secure way to make a temp file.
+if test "$tmp_tagfile" =3D none; then
+        tmpdir=3D$tmp/tcltag$$
+        OLD_UMASK=3D`umask`
+        umask 077
+        getout=3Dno
+        mkdir $tmpdir || getout=3Dyes
+        umask $OLD_UMASK
+        if test $getout =3D yes; then
+                echo "Could not create directory for tcltag, exiting."
+                exit 1
+        fi
+        tmp_tagfile=3D$tmpdir/tcltag
+        touch $tmp_tagfile
+        TODELETE=3D$tmpdir
+else
+        TODELETE=3D$tmp_tagfile
+fi
+# remove the copy of the tcltag file on exit
+trap "rm -rf $TODELETE" 0 1 2 3 9 11 13 15
+
=20
 usage=3D"\
 Usage: $program_name [-au] [-{f|o} tagfile] [--format=3Dn] file(s)
@@ -154,6 +178,5 @@
 else
     cp $tmp_tagfile $tagfile
 fi
-rm $tmp_tagfile
=20
 exit 0
diff -Nru vim-6.3.old/vim63/runtime/tools/vimspell.sh vim-6.3/vim63/runtime=
/tools/vimspell.sh
--- vim-6.3.old/vim63/runtime/tools/vimspell.sh	1999-08-01 14:01:46.0000000=
00 +0200
+++ vim-6.3/vim63/runtime/tools/vimspell.sh	2005-01-09 20:51:18.000000000 +=
0100
@@ -13,9 +13,20 @@
 # March 1999
=20
 INFILE=3D$1
-OUTFILE=3D/tmp/vimspell.$$
-# if you have "tempfile", use the following line
-#OUTFILE=3D`tempfile`
+tmp=3D"${TMPDIR-/tmp}"
+OUTFILE=3D`mktemp -t vimspellXXXXXX || tempfile -p vimspell || echo none`
+# If the standard commands failed then create the file
+# since we cannot create a directory (we cannot remove it on exit)
+# create a file in the safest way possible.
+if test "$OUTFILE" =3D none; then
+        OUTFILE=3D$tmp/vimspell$$
+	[ -e $OUTFILE ] && { echo "Cannot use temporary file $OUTFILE, it already=
 exists!; exit 1 ; }=20
+        (umask 077; touch $OUTFILE)
+fi
+# Note the copy of vimspell cannot be deleted on exit since it is
+# used by vim, otherwise it should do this:
+# trap "rm -f $OUTFILE" 0 1 2 3 9 11 13 15
+
=20
 #
 # local spellings

--AhhlLboLdkugWU4S--

--2B/JsCI69OhZNC5r
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFB4Y6Gi4sehJTrj0oRAj6UAJ0aSUf4pjG3D/5O/X62tJ1gtzGX0gCgwNqo
FZIKf6HleDHHBtxzRqs3oW0=
=0KeP
-----END PGP SIGNATURE-----

--2B/JsCI69OhZNC5r--

Revision history for this message

Debian Bug Importer (debzilla) wrote on 2005-01-18:

#12

Message-ID: <email address hidden>
Date: Sun, 9 Jan 2005 22:24:11 +0100
From: Javier =?iso-8859-1?Q?Fern=E1ndez-Sanguino_Pe=F1a?= <email address hidden>
To: Bram Moolenaar <email address hidden>
Cc: <email address hidden>
Subject: Re: vim: Race conditions and symlink attacks in vim (tcltags and vimspell)

--h31gzZEtNLTqOjlF
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Sun, Jan 09, 2005 at 10:02:35PM +0100, Bram Moolenaar wrote:
>=20
> Javier -
>=20
> > Reviewing vim as part of the security audit the Audit team [1] is=20
> > conducting I've found what I believe are some race conditions and symli=
nk=20
> > attacks through temporary files in vim. They appear in two scripts whic=
h=20
> > are not installed in Debian in binary locations (they are installed und=
er
> > /usr/share/doc/vim/tools/) but are provided with execute permissions.
>=20
> Thanks for looking into this and providing patches.
>=20
> Did you contact the original authors, Darren Hiebert and Neil
> Schemenauer?

No, I didn't. I was not sure if they were still active. Do you want me to=
=20
forward this?

> I wonder if there isn't a shorter method. The handling of the temp file
> becomes more than half the script this way.

Actually, there is, you could remove the lines that try to use a temporary
file in a temporary directory (below the comments) and just abort with a=20
"Cannot create temporary file" message if tmp_tagfile (or OUTFILE) are=20
'none'.

Regards

Javier

--h31gzZEtNLTqOjlF
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFB4aD7i4sehJTrj0oRAsBOAJ0Yq+XhvkJHMktJ2AeHx+m+23Z9GQCeJJ5+
GN96nagKmHLn6ZOPi1WuG4g=
=Clm9
-----END PGP SIGNATURE-----

--h31gzZEtNLTqOjlF--

Revision history for this message

Debian Bug Importer (debzilla) wrote on 2005-01-18:

#13

Message-Id: <email address hidden>
Date: Mon, 10 Jan 2005 10:33:00 +0100
From: Bram Moolenaar <email address hidden>
To: Javier =?iso-8859-1?Q?Fern=E1ndez-Sanguino_Pe=F1a?= <email address hidden>
Cc: <email address hidden>
Subject: Re: vim: Race conditions and symlink attacks in vim (tcltags and vimspell)

Javier -

> > Did you contact the original authors, Darren Hiebert and Neil
> > Schemenauer?
>
> No, I didn't. I was not sure if they were still active. Do you want me to
> forward this?

Yes. They are the authors, thus I hesitate to change their work without
at least trying to contact them.

> > I wonder if there isn't a shorter method. The handling of the temp file
> > becomes more than half the script this way.
>
> Actually, there is, you could remove the lines that try to use a temporary
> file in a temporary directory (below the comments) and just abort with a
> "Cannot create temporary file" message if tmp_tagfile (or OUTFILE) are
> 'none'.

So there would be a few (old?) systems where the script won't work?

--
GALAHAD: No. Look, I can tackle this lot single-handed!
GIRLS: Yes, yes, let him Tackle us single-handed!
"Monty Python and the Holy Grail" PYTHON (MONTY) PICTURES LTD

/// Bram Moolenaar -- <email address hidden> -- http://www.Moolenaar.net \\\
/// Sponsor Vim, vote for features -- http://www.Vim.org/sponsor/ \\\
\\\ Project leader for A-A-P -- http://www.A-A-P.org ///
\\\ Buy LOTR 3 and help AIDS victims -- http://ICCF.nl/lotr.html ///

Revision history for this message

Debian Bug Importer (debzilla) wrote on 2005-01-18:

#14

Message-ID: <email address hidden>
Date: Mon, 10 Jan 2005 10:56:21 +0100
From: Javier =?iso-8859-1?Q?Fern=E1ndez-Sanguino_Pe=F1a?= <email address hidden>
To: Bram Moolenaar <email address hidden>
Cc: <email address hidden>
Subject: Re: vim: Race conditions and symlink attacks in vim (tcltags and vimspell)

--jRHKVT23PllUwdXP
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Mon, Jan 10, 2005 at 10:33:00AM +0100, Bram Moolenaar wrote:
> > > Did you contact the original authors, Darren Hiebert and Neil
> > > Schemenauer?
> >=20
> > No, I didn't. I was not sure if they were still active. Do you want me =
to=20
> > forward this?
>=20
> Yes. They are the authors, thus I hesitate to change their work without
> at least trying to contact them.

Ok. Will do.

>=20
> > > I wonder if there isn't a shorter method. The handling of the temp f=
ile
> > > becomes more than half the script this way.
> >=20
> > Actually, there is, you could remove the lines that try to use a tempor=
ary
> > file in a temporary directory (below the comments) and just abort with =
a=20
> > "Cannot create temporary file" message if tmp_tagfile (or OUTFILE) are=
=20
> > 'none'.
>=20
> So there would be a few (old?) systems where the script won't work?

Correct. Those that don't have mktemp or tempfile. These should be=20
available in most Linux distributions but I'm not sure about their=20
availability in other UNIX systems (I believe mktemp is available in=20
Solaris, in HP-UX and in Tru64 but not in AIX, for example)

Regards

Javier

--jRHKVT23PllUwdXP
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFB4lFEi4sehJTrj0oRAj/oAJ4noEvzB1xylY3V/ZJK5ig9zikIZACgmxCG
yzQ9eYybzBKTj2DQwuAeM1o=
=Te3y
-----END PGP SIGNATURE-----

--jRHKVT23PllUwdXP--

Revision history for this message

Debian Bug Importer (debzilla) wrote on 2005-01-18:

#15

Message-ID: <email address hidden>
Date: Mon, 10 Jan 2005 11:01:57 +0100
From: Javier =?iso-8859-1?Q?Fern=E1ndez-Sanguino_Pe=F1a?= <email address hidden>
To: Bram Moolenaar <email address hidden>
Cc: <email address hidden>
Subject: Re: vim: Race conditions and symlink attacks in vim (tcltags and vimspell)

--C7zPtVaVf+AK4Oqc
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Mon, Jan 10, 2005 at 10:33:00AM +0100, Bram Moolenaar wrote:
>=20
> Javier -
>=20
> > > Did you contact the original authors, Darren Hiebert and Neil
> > > Schemenauer?
> >=20
> > No, I didn't. I was not sure if they were still active. Do you want me =
to=20
> > forward this?
>=20
> Yes. They are the authors, thus I hesitate to change their work without
> at least trying to contact them.

At least one of the mail addresses (<email address hidden>) bounces.

Regards

Javier

--C7zPtVaVf+AK4Oqc
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFB4lKVi4sehJTrj0oRAgzhAJwIzXD4zsWypd85IW0hrDNo+LBHMgCeOY/i
Cz0yawlLrADOXtmOJ8NF640=
=ar6A
-----END PGP SIGNATURE-----

--C7zPtVaVf+AK4Oqc--

Revision history for this message

Debian Bug Importer (debzilla) wrote on 2005-01-18:

#16

Message-ID: <email address hidden>
Date: Mon, 10 Jan 2005 11:43:10 +0100
From: Javier =?iso-8859-1?Q?Fern=E1ndez-Sanguino_Pe=F1a?= <email address hidden>
To: Bram Moolenaar <email address hidden>
Cc: <email address hidden>
Subject: Re: vim: Race conditions and symlink attacks in vim (tcltags and vimspell)

--G4iJoqBmSsgzjUCe
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Mon, Jan 10, 2005 at 11:01:57AM +0100, Javier Fern=E1ndez-Sanguino Pe=F1=
a wrote:
> At least one of the mail addresses (<email address hidden>) bounces.

The other author address (<email address hidden>) bounces too.

Regards

Javier

--G4iJoqBmSsgzjUCe
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFB4lw9i4sehJTrj0oRAozwAJ9upECIqyGyB8vBkPhiuHMxynouQgCgzcPj
lYDYqqTjW3k/md2HT6ciZX4=
=8RO4
-----END PGP SIGNATURE-----

--G4iJoqBmSsgzjUCe--

Revision history for this message

Debian Bug Importer (debzilla) wrote on 2005-01-18:

#17

Message-ID: <email address hidden>
Date: Fri, 14 Jan 2005 12:30:15 +0000 (GMT)
From: Mark J Cox <email address hidden>
To: <email address hidden>
Subject: [<email address hidden>: Re: CVE request] (fwd

This is CAN-2005-0069.

Revision history for this message

Debian Bug Importer (debzilla) wrote on 2005-01-18:

#18

Message-ID: <email address hidden>
Date: Fri, 14 Jan 2005 14:16:06 +0100
From: Martin Schulze <email address hidden>
To: <email address hidden>
Subject: cve id

Please use CAN-2005-0069.

Regards,

Joey

--
The MS-DOS filesystem is nice for removable media. -- H. Peter Anvin

Please always Cc to me when replying to me on the lists.

Revision history for this message

Debian Bug Importer (debzilla) wrote on 2005-01-18:

#19

Message-ID: <email address hidden>
Date: Sat, 15 Jan 2005 20:42:35 +0100
From: Norbert Tretkowski <email address hidden>
To: <email address hidden>
Subject: tags

tags 289560 +pending
thanks

Norbert

Revision history for this message

Debian Bug Importer (debzilla) wrote on 2005-01-18:

#20

Message-ID: <email address hidden>
Date: Tue, 18 Jan 2005 23:45:40 +0100
From: Norbert Tretkowski <email address hidden>
To: Joey Hess <email address hidden>, <email address hidden>
Cc: <email address hidden>
Subject: Re: Bug#291125: vim: temporary file vulnerabilities (CAN-2005-0069)

severity 289560 grave
merge 289560 291125
thanks

* Joey Hess wrote:
> As described in the Ubuntu advisory below, vim's tcltags and vimspell
> scripts use temp files insecurely.

Updated package is already building currently.

Norbert

Revision history for this message

Debian Bug Importer (debzilla) wrote on 2005-01-18:

#21

*** Bug 12027 has been marked as a duplicate of this bug. ***

Revision history for this message

In Debian Bug tracker #289560, Norbert Tretkowski (tretkowski) wrote on 2005-01-19: Bug#289560: fixed in vim 1:6.3-058+1

#22

Download full text (5.2 KiB)

Source: vim
Source-Version: 1:6.3-058+1

We believe that the bug you reported is fixed in the latest version of
vim, which is due to be installed in the Debian FTP archive:

kvim-perl_6.3-058+1_alpha.deb
  to pool/main/v/vim/kvim-perl_6.3-058+1_alpha.deb
kvim-python_6.3-058+1_alpha.deb
  to pool/main/v/vim/kvim-python_6.3-058+1_alpha.deb
kvim-ruby_6.3-058+1_alpha.deb
  to pool/main/v/vim/kvim-ruby_6.3-058+1_alpha.deb
kvim-tcl_6.3-058+1_alpha.deb
  to pool/main/v/vim/kvim-tcl_6.3-058+1_alpha.deb
kvim_6.3-058+1_alpha.deb
  to pool/main/v/vim/kvim_6.3-058+1_alpha.deb
vim-common_6.3-058+1_all.deb
  to pool/main/v/vim/vim-common_6.3-058+1_all.deb
vim-doc_6.3-058+1_all.deb
  to pool/main/v/vim/vim-doc_6.3-058+1_all.deb
vim-gnome_6.3-058+1_alpha.deb
  to pool/main/v/vim/vim-gnome_6.3-058+1_alpha.deb
vim-gtk_6.3-058+1_alpha.deb
  to pool/main/v/vim/vim-gtk_6.3-058+1_alpha.deb
vim-lesstif_6.3-058+1_alpha.deb
  to pool/main/v/vim/vim-lesstif_6.3-058+1_alpha.deb
vim-perl_6.3-058+1_alpha.deb
  to pool/main/v/vim/vim-perl_6.3-058+1_alpha.deb
vim-python_6.3-058+1_alpha.deb
  to pool/main/v/vim/vim-python_6.3-058+1_alpha.deb
vim-ruby_6.3-058+1_alpha.deb
  to pool/main/v/vim/vim-ruby_6.3-058+1_alpha.deb
vim-tcl_6.3-058+1_alpha.deb
  to pool/main/v/vim/vim-tcl_6.3-058+1_alpha.deb
vim_6.3-058+1.diff.gz
  to pool/main/v/vim/vim_6.3-058+1.diff.gz
vim_6.3-058+1.dsc
  to pool/main/v/vim/vim_6.3-058+1.dsc
vim_6.3-058+1_alpha.deb
  to pool/main/v/vim/vim_6.3-058+1_alpha.deb

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to <email address hidden>,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Norbert Tretkowski <email address hidden> (supplier of updated vim package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing <email address hidden>)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.7
Date: Tue, 18 Jan 2005 20:12:25 +0100
Source: vim
Binary: vim-lesstif vim-common vim-doc vim-gnome kvim-ruby vim vim-gtk kvim-perl vim-perl kvim-tcl vim-tiny vim-ruby vim-python vim-tcl kvim-python kvim
Architecture: source alpha all
Version: 1:6.3-058+1
Distribution: unstable
Urgency: high
Maintainer: Norbert Tretkowski <email address hidden>
Changed-By: Norbert Tretkowski <email address hidden>
Description:
kvim - Vi IMproved - KDE 3.x version
kvim-perl - Vi IMproved - KDE 3.x version with Perl scripting support
kvim-python - Vi IMproved - KDE 3.x version with Python scripting support
kvim-ruby - Vi IMproved - KDE 3.x version with Ruby scripting support
kvim-tcl - Vi IMproved - KDE 3.x version with TCL scripting support
vim - Vi IMproved - enhanced vi editor
vim-common - Vi IMproved - Common files
vim-doc - Vi IMproved - Documentation files
vim-gnome - Vi IMproved - GNOME2 Version
vim-gtk - Vi IMproved - GTK2 Version
vim-lesstif - Vi IMproved - LessTif Version
vim-perl - Vi IMproved, with perl scripting support
vim-python - Vi IMpr...

Source: vim
Source-Version: 1:6.3-058+1

We believe that the bug you reported is fixed in the latest version of
vim, which is due to be installed in the Debian FTP archive:

kvim-perl_6.3-058+1_alpha.deb
  to pool/main/v/vim/kvim-perl_6.3-058+1_alpha.deb
kvim-python_6.3-058+1_alpha.deb
  to pool/main/v/vim/kvim-python_6.3-058+1_alpha.deb
kvim-ruby_6.3-058+1_alpha.deb
  to pool/main/v/vim/kvim-ruby_6.3-058+1_alpha.deb
kvim-tcl_6.3-058+1_alpha.deb
  to pool/main/v/vim/kvim-tcl_6.3-058+1_alpha.deb
kvim_6.3-058+1_alpha.deb
  to pool/main/v/vim/kvim_6.3-058+1_alpha.deb
vim-common_6.3-058+1_all.deb
  to pool/main/v/vim/vim-common_6.3-058+1_all.deb
vim-doc_6.3-058+1_all.deb
  to pool/main/v/vim/vim-doc_6.3-058+1_all.deb
vim-gnome_6.3-058+1_alpha.deb
  to pool/main/v/vim/vim-gnome_6.3-058+1_alpha.deb
vim-gtk_6.3-058+1_alpha.deb
  to pool/main/v/vim/vim-gtk_6.3-058+1_alpha.deb
vim-lesstif_6.3-058+1_alpha.deb
  to pool/main/v/vim/vim-lesstif_6.3-058+1_alpha.deb
vim-perl_6.3-058+1_alpha.deb
  to pool/main/v/vim/vim-perl_6.3-058+1_alpha.deb
vim-python_6.3-058+1_alpha.deb
  to pool/main/v/vim/vim-python_6.3-058+1_alpha.deb
vim-ruby_6.3-058+1_alpha.deb
  to pool/main/v/vim/vim-ruby_6.3-058+1_alpha.deb
vim-tcl_6.3-058+1_alpha.deb
  to pool/main/v/vim/vim-tcl_6.3-058+1_alpha.deb
vim_6.3-058+1.diff.gz
  to pool/main/v/vim/vim_6.3-058+1.diff.gz
vim_6.3-058+1.dsc
  to pool/main/v/vim/vim_6.3-058+1.dsc
vim_6.3-058+1_alpha.deb
  to pool/main/v/vim/vim_6.3-058+1_alpha.deb

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 289560@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Norbert Tretkowski <nobse@debian.org> (supplier of updated vim package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.7
Date: Tue, 18 Jan 2005 20:12:25 +0100
Source: vim
Binary: vim-lesstif vim-common vim-doc vim-gnome kvim-ruby vim vim-gtk kvim-perl vim-perl kvim-tcl vim-tiny vim-ruby vim-python vim-tcl kvim-python kvim
Architecture: source alpha all
Version: 1:6.3-058+1
Distribution: unstable
Urgency: high
Maintainer: Norbert Tretkowski <nobse@debian.org>
Changed-By: Norbert Tretkowski <nobse@debian.org>
Description: 
 kvim       - Vi IMproved - KDE 3.x version
 kvim-perl  - Vi IMproved - KDE 3.x version with Perl scripting support
 kvim-python - Vi IMproved - KDE 3.x version with Python scripting support
 kvim-ruby  - Vi IMproved - KDE 3.x version with Ruby scripting support
 kvim-tcl   - Vi IMproved - KDE 3.x version with TCL scripting support
 vim        - Vi IMproved - enhanced vi editor
 vim-common - Vi IMproved - Common files
 vim-doc    - Vi IMproved - Documentation files
 vim-gnome  - Vi IMproved - GNOME2 Version
 vim-gtk    - Vi IMproved - GTK2 Version
 vim-lesstif - Vi IMproved - LessTif Version
 vim-perl   - Vi IMproved, with perl scripting support
 vim-python - Vi IMproved, with python scripting support
 vim-ruby   - Vi IMproved, with ruby scripting support
 vim-tcl    - Vi IMproved, with tcl scripting support
Closes: 289560
Changes: 
 vim (1:6.3-058+1) unstable; urgency=high
 .
   * new upstream patches (055 to 058), see README.gz for details
   * added a new patch (stolen from Ubuntu) which modifies vimspell.sh and
     tcltags.sh so they use mktemp instead of insecure $$ construction to
     create temporary files (CAN-2005-0069) (closes: #289560)
Files: 
 40905ece508f1000b53e1cb0b1a0b679 1114 editors optional vim_6.3-058+1.dsc
 2a764ada0d4dd2892216d998ee424257 459960 editors optional vim_6.3-058+1.diff.gz
 3be4f39ae87c85af51774b43842f852a 1599902 editors optional vim-doc_6.3-058+1_all.deb
 aa8f4256bcea255a870d42f41095f54f 3422002 editors extra vim-common_6.3-058+1_all.deb
 f98fcfb0ac9f26668d2b9c50c8b8b431 899984 editors optional vim_6.3-058+1_alpha.deb
 57c868841b4003df54d6f987c4bbdac4 1071112 editors extra kvim-perl_6.3-058+1_alpha.deb
 05337f051d46820de859772559c78139 958048 editors extra vim-perl_6.3-058+1_alpha.deb
 de1bd16ca6ec536da4957e12101a2970 1065922 editors extra kvim-python_6.3-058+1_alpha.deb
 104772252250acd9e35eb16e1b46e395 952474 editors extra vim-python_6.3-058+1_alpha.deb
 f035d0ca05939a17677acfa333e48fb4 1059382 editors extra kvim-ruby_6.3-058+1_alpha.deb
 f4d69d869fda4e6fd655b9d4229fd792 947204 editors extra vim-ruby_6.3-058+1_alpha.deb
 7ab3e529cbd43991d48c8dda291116a8 1023598 editors extra kvim-tcl_6.3-058+1_alpha.deb
 5dc0fafa0034556186a396c14a99274a 952276 editors extra vim-tcl_6.3-058+1_alpha.deb
 bc9d36d4e37c120fa30b37ef5f6a66ba 941254 editors extra vim-gtk_6.3-058+1_alpha.deb
 f32726f0b47e5c361b2aa21f16f2e118 881260 editors extra vim-lesstif_6.3-058+1_alpha.deb
 d0c6f0b0576fc1861f5f8cc92e63bd19 944624 editors extra vim-gnome_6.3-058+1_alpha.deb
 c6c1d71c24df7a1aeea026905a3e09d5 1013734 editors extra kvim_6.3-058+1_alpha.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFB7gZvr/RnCw96jQERAhWYAJ9UkUmPjUQDlvNVCfJSKDP03U7JxQCgoqhG
mJk6cJVq2LlVKW2RgSZ/NrM=
=djsk
-----END PGP SIGNATURE-----

Revision history for this message

Debian Bug Importer (debzilla) wrote on 2005-01-19:

#23

Download full text (5.4 KiB)

Message-Id: <email address hidden>
Date: Wed, 19 Jan 2005 02:17:20 -0500
From: Norbert Tretkowski <email address hidden>
To: <email address hidden>
Subject: Bug#289560: fixed in vim 1:6.3-058+1

Source: vim
Source-Version: 1:6.3-058+1

We believe that the bug you reported is fixed in the latest version of
vim, which is due to be installed in the Debian FTP archive:

kvim-perl_6.3-058+1_alpha.deb
  to pool/main/v/vim/kvim-perl_6.3-058+1_alpha.deb
kvim-python_6.3-058+1_alpha.deb
  to pool/main/v/vim/kvim-python_6.3-058+1_alpha.deb
kvim-ruby_6.3-058+1_alpha.deb
  to pool/main/v/vim/kvim-ruby_6.3-058+1_alpha.deb
kvim-tcl_6.3-058+1_alpha.deb
  to pool/main/v/vim/kvim-tcl_6.3-058+1_alpha.deb
kvim_6.3-058+1_alpha.deb
  to pool/main/v/vim/kvim_6.3-058+1_alpha.deb
vim-common_6.3-058+1_all.deb
  to pool/main/v/vim/vim-common_6.3-058+1_all.deb
vim-doc_6.3-058+1_all.deb
  to pool/main/v/vim/vim-doc_6.3-058+1_all.deb
vim-gnome_6.3-058+1_alpha.deb
  to pool/main/v/vim/vim-gnome_6.3-058+1_alpha.deb
vim-gtk_6.3-058+1_alpha.deb
  to pool/main/v/vim/vim-gtk_6.3-058+1_alpha.deb
vim-lesstif_6.3-058+1_alpha.deb
  to pool/main/v/vim/vim-lesstif_6.3-058+1_alpha.deb
vim-perl_6.3-058+1_alpha.deb
  to pool/main/v/vim/vim-perl_6.3-058+1_alpha.deb
vim-python_6.3-058+1_alpha.deb
  to pool/main/v/vim/vim-python_6.3-058+1_alpha.deb
vim-ruby_6.3-058+1_alpha.deb
  to pool/main/v/vim/vim-ruby_6.3-058+1_alpha.deb
vim-tcl_6.3-058+1_alpha.deb
  to pool/main/v/vim/vim-tcl_6.3-058+1_alpha.deb
vim_6.3-058+1.diff.gz
  to pool/main/v/vim/vim_6.3-058+1.diff.gz
vim_6.3-058+1.dsc
  to pool/main/v/vim/vim_6.3-058+1.dsc
vim_6.3-058+1_alpha.deb
  to pool/main/v/vim/vim_6.3-058+1_alpha.deb

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to <email address hidden>,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Norbert Tretkowski <email address hidden> (supplier of updated vim package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing <email address hidden>)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.7
Date: Tue, 18 Jan 2005 20:12:25 +0100
Source: vim
Binary: vim-lesstif vim-common vim-doc vim-gnome kvim-ruby vim vim-gtk kvim-perl vim-perl kvim-tcl vim-tiny vim-ruby vim-python vim-tcl kvim-python kvim
Architecture: source alpha all
Version: 1:6.3-058+1
Distribution: unstable
Urgency: high
Maintainer: Norbert Tretkowski <email address hidden>
Changed-By: Norbert Tretkowski <email address hidden>
Description:
kvim - Vi IMproved - KDE 3.x version
kvim-perl - Vi IMproved - KDE 3.x version with Perl scripting support
kvim-python - Vi IMproved - KDE 3.x version with Python scripting support
kvim-ruby - Vi IMproved - KDE 3.x version with Ruby scripting support
kvim-tcl - Vi IMproved - KDE 3.x version with TCL scripting support
vim - Vi IMproved - enhanced vi editor
vim-common - Vi IMproved - Common files
vim-doc - Vi IMproved - Documentatio...

Message-Id: <E1CrA5g-0005d8-00@newraff.debian.org>
Date: Wed, 19 Jan 2005 02:17:20 -0500
From: Norbert Tretkowski <nobse@debian.org>
To: 289560-close@bugs.debian.org
Subject: Bug#289560: fixed in vim 1:6.3-058+1

Source: vim
Source-Version: 1:6.3-058+1

We believe that the bug you reported is fixed in the latest version of
vim, which is due to be installed in the Debian FTP archive:

kvim-perl_6.3-058+1_alpha.deb
  to pool/main/v/vim/kvim-perl_6.3-058+1_alpha.deb
kvim-python_6.3-058+1_alpha.deb
  to pool/main/v/vim/kvim-python_6.3-058+1_alpha.deb
kvim-ruby_6.3-058+1_alpha.deb
  to pool/main/v/vim/kvim-ruby_6.3-058+1_alpha.deb
kvim-tcl_6.3-058+1_alpha.deb
  to pool/main/v/vim/kvim-tcl_6.3-058+1_alpha.deb
kvim_6.3-058+1_alpha.deb
  to pool/main/v/vim/kvim_6.3-058+1_alpha.deb
vim-common_6.3-058+1_all.deb
  to pool/main/v/vim/vim-common_6.3-058+1_all.deb
vim-doc_6.3-058+1_all.deb
  to pool/main/v/vim/vim-doc_6.3-058+1_all.deb
vim-gnome_6.3-058+1_alpha.deb
  to pool/main/v/vim/vim-gnome_6.3-058+1_alpha.deb
vim-gtk_6.3-058+1_alpha.deb
  to pool/main/v/vim/vim-gtk_6.3-058+1_alpha.deb
vim-lesstif_6.3-058+1_alpha.deb
  to pool/main/v/vim/vim-lesstif_6.3-058+1_alpha.deb
vim-perl_6.3-058+1_alpha.deb
  to pool/main/v/vim/vim-perl_6.3-058+1_alpha.deb
vim-python_6.3-058+1_alpha.deb
  to pool/main/v/vim/vim-python_6.3-058+1_alpha.deb
vim-ruby_6.3-058+1_alpha.deb
  to pool/main/v/vim/vim-ruby_6.3-058+1_alpha.deb
vim-tcl_6.3-058+1_alpha.deb
  to pool/main/v/vim/vim-tcl_6.3-058+1_alpha.deb
vim_6.3-058+1.diff.gz
  to pool/main/v/vim/vim_6.3-058+1.diff.gz
vim_6.3-058+1.dsc
  to pool/main/v/vim/vim_6.3-058+1.dsc
vim_6.3-058+1_alpha.deb
  to pool/main/v/vim/vim_6.3-058+1_alpha.deb

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 289560@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Norbert Tretkowski <nobse@debian.org> (supplier of updated vim package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.7
Date: Tue, 18 Jan 2005 20:12:25 +0100
Source: vim
Binary: vim-lesstif vim-common vim-doc vim-gnome kvim-ruby vim vim-gtk kvim-perl vim-perl kvim-tcl vim-tiny vim-ruby vim-python vim-tcl kvim-python kvim
Architecture: source alpha all
Version: 1:6.3-058+1
Distribution: unstable
Urgency: high
Maintainer: Norbert Tretkowski <nobse@debian.org>
Changed-By: Norbert Tretkowski <nobse@debian.org>
Description: 
 kvim       - Vi IMproved - KDE 3.x version
 kvim-perl  - Vi IMproved - KDE 3.x version with Perl scripting support
 kvim-python - Vi IMproved - KDE 3.x version with Python scripting support
 kvim-ruby  - Vi IMproved - KDE 3.x version with Ruby scripting support
 kvim-tcl   - Vi IMproved - KDE 3.x version with TCL scripting support
 vim        - Vi IMproved - enhanced vi editor
 vim-common - Vi IMproved - Common files
 vim-doc    - Vi IMproved - Documentation files
 vim-gnome  - Vi IMproved - GNOME2 Version
 vim-gtk    - Vi IMproved - GTK2 Version
 vim-lesstif - Vi IMproved - LessTif Version
 vim-perl   - Vi IMproved, with perl scripting support
 vim-python - Vi IMproved, with python scripting support
 vim-ruby   - Vi IMproved, with ruby scripting support
 vim-tcl    - Vi IMproved, with tcl scripting support
Closes: 289560
Changes: 
 vim (1:6.3-058+1) unstable; urgency=high
 .
   * new upstream patches (055 to 058), see README.gz for details
   * added a new patch (stolen from Ubuntu) which modifies vimspell.sh and
     tcltags.sh so they use mktemp instead of insecure $$ construction to
     create temporary files (CAN-2005-0069) (closes: #289560)
Files: 
 40905ece508f1000b53e1cb0b1a0b679 1114 editors optional vim_6.3-058+1.dsc
 2a764ada0d4dd2892216d998ee424257 459960 editors optional vim_6.3-058+1.diff.gz
 3be4f39ae87c85af51774b43842f852a 1599902 editors optional vim-doc_6.3-058+1_all.deb
 aa8f4256bcea255a870d42f41095f54f 3422002 editors extra vim-common_6.3-058+1_all.deb
 f98fcfb0ac9f26668d2b9c50c8b8b431 899984 editors optional vim_6.3-058+1_alpha.deb
 57c868841b4003df54d6f987c4bbdac4 1071112 editors extra kvim-perl_6.3-058+1_alpha.deb
 05337f051d46820de859772559c78139 958048 editors extra vim-perl_6.3-058+1_alpha.deb
 de1bd16ca6ec536da4957e12101a2970 1065922 editors extra kvim-python_6.3-058+1_alpha.deb
 104772252250acd9e35eb16e1b46e395 952474 editors extra vim-python_6.3-058+1_alpha.deb
 f035d0ca05939a17677acfa333e48fb4 1059382 editors extra kvim-ruby_6.3-058+1_alpha.deb
 f4d69d869fda4e6fd655b9d4229fd792 947204 editors extra vim-ruby_6.3-058+1_alpha.deb
 7ab3e529cbd43991d48c8dda291116a8 1023598 editors extra kvim-tcl_6.3-058+1_alpha.deb
 5dc0fafa0034556186a396c14a99274a 952276 editors extra vim-tcl_6.3-058+1_alpha.deb
 bc9d36d4e37c120fa30b37ef5f6a66ba 941254 editors extra vim-gtk_6.3-058+1_alpha.deb
 f32726f0b47e5c361b2aa21f16f2e118 881260 editors extra vim-lesstif_6.3-058+1_alpha.deb
 d0c6f0b0576fc1861f5f8cc92e63bd19 944624 editors extra vim-gnome_6.3-058+1_alpha.deb
 c6c1d71c24df7a1aeea026905a3e09d5 1013734 editors extra kvim_6.3-058+1_alpha.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFB7gZvr/RnCw96jQERAhWYAJ9UkUmPjUQDlvNVCfJSKDP03U7JxQCgoqhG
mJk6cJVq2LlVKW2RgSZ/NrM=
=djsk
-----END PGP SIGNATURE-----

Revision history for this message

In Debian Bug tracker #289560, Javier Fernández-Sanguino (jfs) wrote on 2005-01-19: Re: Bug#289560 acknowledged by developer (Bug#289560: fixed in vim 1:6.3-058+1)

#24

> * added a new patch (stolen from Ubuntu) which modifies vimspell.sh and
> tcltags.sh so they use mktemp instead of insecure $$ construction to
> create temporary files (CAN-2005-0069) (closes: #289560)

A few comments and questions regarding this entry:

- the scripts seem to be ancient and no longer supported by either their
authors nor vim maintainer and have been removed upstream.

- I understand that Ubuntu's patch might be simpler, but I actually wrote
the patch based on what's done in vim's tcltutor script. There were some
reasons I wrote it which have been disregarded (mostly compatibility
reasons for things that don't have mktemp/tempfile)
(I can't find it in Ubuntu's bugzilla 5633 but found it in our BTS #291125)

- no credit is given to me, which I would have appreciated

- Ubuntu's patch for tcltags will remove the temporary file *twice* (once
on exit, once after the trap is called) as the last line of the script has
not been removed (rm $tmp_tagfile) as I did in my patch.

Regards

Javier

Revision history for this message

Debian Bug Importer (debzilla) wrote on 2005-01-19:

#25

Message-ID: <email address hidden>
Date: Wed, 19 Jan 2005 09:08:38 +0100
From: Javier =?iso-8859-1?Q?Fern=E1ndez-Sanguino_Pe=F1a?= <email address hidden>
To: <email address hidden>
Cc: Javier =?iso-8859-1?Q?Fern=E1ndez-Sanguino_Pe=F1a?= <email address hidden>
Subject: Re: Bug#289560 acknowledged by developer (Bug#289560: fixed in vim 1:6.3-058+1)

--fdj2RfSjLxBAspz7
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

> * added a new patch (stolen from Ubuntu) which modifies vimspell.sh and
> tcltags.sh so they use mktemp instead of insecure $$ construction to
> create temporary files (CAN-2005-0069) (closes: #289560)

A few comments and questions regarding this entry:

- the scripts seem to be ancient and no longer supported by either their=20
authors nor vim maintainer and have been removed upstream.

- I understand that Ubuntu's patch might be simpler, but I actually wrote=
=20
the patch based on what's done in vim's tcltutor script. There were some=20
reasons I wrote it which have been disregarded (mostly compatibility=20
reasons for things that don't have mktemp/tempfile)
(I can't find it in Ubuntu's bugzilla 5633 but found it in our BTS #291125)

- no credit is given to me, which I would have appreciated

- Ubuntu's patch for tcltags will remove the temporary file *twice* (once
on exit, once after the trap is called) as the last line of the script has
not been removed (rm $tmp_tagfile) as I did in my patch.

Regards

Javier

--fdj2RfSjLxBAspz7
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFB7hWGi4sehJTrj0oRAqDnAKC/VNkaR3c53ic2WJvChz1GVEX1JwCeM+8u
BJ2Ur/vRHN1jeh4AirAXiOY=
=fC6E
-----END PGP SIGNATURE-----

--fdj2RfSjLxBAspz7--

Revision history for this message

In Debian Bug tracker #289560, Martin Pitt (pitti) wrote on 2005-01-19: Re: Bug#289560: acknowledged by developer (Bug#289560: fixed in vim 1:6.3-058+1)

#26

Hi Javier!

Javier Fernández-Sanguino Peña [2005-01-19 9:08 +0100]:
> > * added a new patch (stolen from Ubuntu) which modifies vimspell.sh and
> > tcltags.sh so they use mktemp instead of insecure $$ construction to
> > create temporary files (CAN-2005-0069) (closes: #289560)
>
> A few comments and questions regarding this entry:
>
> - the scripts seem to be ancient and no longer supported by either their
> authors nor vim maintainer and have been removed upstream.

Maybe, but still we ship them in our stable release, so we must fix
it.

> - I understand that Ubuntu's patch might be simpler, but I actually wrote
> the patch based on what's done in vim's tcltutor script. There were some
> reasons I wrote it which have been disregarded (mostly compatibility
> reasons for things that don't have mktemp/tempfile)
> (I can't find it in Ubuntu's bugzilla 5633 but found it in our BTS #291125)

I read your patch, but I deliberately wrote my own very simple
version, because:

- I wanted to avoid the tempfile race in any case, so if mktemp is not
available, the script should rather fail than be vulnerable. mktemp
is shipped in a required package, so we can assume it is there.

- A security update must be as simple and unintrusive as possible. I
  do not care about the widest possible upstream portability in
  security updates, the solution only needs to work on the platforms
  we support.

> - no credit is given to me, which I would have appreciated

I credited you in the announcement [1] since you found the bug.
However, since I did not take your patch, but wrote my own, I did not
credit you for the patch (so if it's broken, it is seen as my fault
and not yours :-) ).

[1] http://www.ubuntulinux.org/support/documentation/usn/usn-61-1

> - Ubuntu's patch for tcltags will remove the temporary file *twice* (once
> on exit, once after the trap is called) as the last line of the script has
> not been removed (rm $tmp_tagfile) as I did in my patch.

Right, thanks for that hint. It would be nice to fix that in Sid and
our development release.

Have a nice day!

Martin

--
Martin Pitt http://www.piware.de
Ubuntu Developer http://www.ubuntulinux.org
Debian GNU/Linux Developer http://www.debian.org

Hi Javier!

Javier Fernández-Sanguino Peña [2005-01-19  9:08 +0100]:
> >    * added a new patch (stolen from Ubuntu) which modifies vimspell.sh and
> >      tcltags.sh so they use mktemp instead of insecure $$ construction to
> >      create temporary files (CAN-2005-0069) (closes: #289560)
> 
> A few comments and questions regarding this entry:
> 
> - the scripts seem to be ancient and no longer supported by either their 
> authors nor vim maintainer and have been removed upstream.

Maybe, but still we ship them in our stable release, so we must fix
it.

> - I understand that Ubuntu's patch might be simpler, but I actually wrote 
> the patch based on what's done in vim's tcltutor script. There were some 
> reasons I wrote it which have been disregarded (mostly compatibility 
> reasons for things that don't have mktemp/tempfile)
> (I can't find it in Ubuntu's bugzilla 5633 but found it in our BTS #291125)

I read your patch, but I deliberately wrote my own very simple
version, because:

- I wanted to avoid the tempfile race in any case, so if mktemp is not
  available, the script should rather fail than be vulnerable. mktemp
  is shipped in a required package, so we can assume it is there.

- A security update must be as simple and unintrusive as possible. I
  do not care about the widest possible upstream portability in
  security updates, the solution only needs to work on the platforms
  we support.

> - no credit is given to me, which I would have appreciated

I credited you in the announcement [1] since you found the bug.
However, since I did not take your patch, but wrote my own, I did not
credit you for the patch (so if it's broken, it is seen as my fault
and not yours :-) ).

[1] http://www.ubuntulinux.org/support/documentation/usn/usn-61-1

> - Ubuntu's patch for tcltags will remove the temporary file *twice* (once
> on exit, once after the trap is called) as the last line of the script has
> not been removed (rm $tmp_tagfile) as I did in my patch.

Right, thanks for that hint. It would be nice to fix that in Sid and
our development release.

Have a nice day!

Martin

-- 
Martin Pitt                       http://www.piware.de
Ubuntu Developer            http://www.ubuntulinux.org
Debian GNU/Linux Developer       http://www.debian.org

Revision history for this message

Debian Bug Importer (debzilla) wrote on 2005-01-19:

#27

Message-ID: <email address hidden>
Date: Wed, 19 Jan 2005 10:24:20 +0100
From: Martin Pitt <email address hidden>
To: Javier =?iso-8859-1?Q?Fern=E1ndez-Sanguino_Pe=F1a?= <email address hidden>,
<email address hidden>
Subject: Re: Bug#289560: acknowledged by developer (Bug#289560: fixed in vim 1:6.3-058+1)

--+g7M9IMkV8truYOl
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Hi Javier!

Javier Fern=E1ndez-Sanguino Pe=F1a [2005-01-19 9:08 +0100]:
> > * added a new patch (stolen from Ubuntu) which modifies vimspell.sh =
and
> > tcltags.sh so they use mktemp instead of insecure $$ construction =
to
> > create temporary files (CAN-2005-0069) (closes: #289560)
>=20
> A few comments and questions regarding this entry:
>=20
> - the scripts seem to be ancient and no longer supported by either their=
=20
> authors nor vim maintainer and have been removed upstream.

Maybe, but still we ship them in our stable release, so we must fix
it.

> - I understand that Ubuntu's patch might be simpler, but I actually wrote=
=20
> the patch based on what's done in vim's tcltutor script. There were some=
=20
> reasons I wrote it which have been disregarded (mostly compatibility=20
> reasons for things that don't have mktemp/tempfile)
> (I can't find it in Ubuntu's bugzilla 5633 but found it in our BTS #29112=
5)

I read your patch, but I deliberately wrote my own very simple
version, because:

- I wanted to avoid the tempfile race in any case, so if mktemp is not
available, the script should rather fail than be vulnerable. mktemp
is shipped in a required package, so we can assume it is there.

- A security update must be as simple and unintrusive as possible. I
  do not care about the widest possible upstream portability in
  security updates, the solution only needs to work on the platforms
  we support.

> - no credit is given to me, which I would have appreciated

I credited you in the announcement [1] since you found the bug.
However, since I did not take your patch, but wrote my own, I did not
credit you for the patch (so if it's broken, it is seen as my fault
and not yours :-) ).

[1] http://www.ubuntulinux.org/support/documentation/usn/usn-61-1

> - Ubuntu's patch for tcltags will remove the temporary file *twice* (once
> on exit, once after the trap is called) as the last line of the script has
> not been removed (rm $tmp_tagfile) as I did in my patch.

Right, thanks for that hint. It would be nice to fix that in Sid and
our development release.

Have a nice day!

Martin

--=20
Martin Pitt http://www.piware.de
Ubuntu Developer http://www.ubuntulinux.org
Debian GNU/Linux Developer http://www.debian.org

--+g7M9IMkV8truYOl
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFB7idEDecnbV4Fd/IRAnJzAKCPbzOma8Nv/Q6r9r5lx7VAOfrqyQCgm2Xd
LX6jAxEVuHe9lnudfadSGCA=
=Bzyo
-----END PGP SIGNATURE-----

--+g7M9IMkV8truYOl--

Message-ID: <20050119092420.GB19600@box79162.elkhouse.de>
Date: Wed, 19 Jan 2005 10:24:20 +0100
From: Martin Pitt <mpitt@debian.org>
To: Javier =?iso-8859-1?Q?Fern=E1ndez-Sanguino_Pe=F1a?= <jfs@computer.org>,
	289560@bugs.debian.org
Subject: Re: Bug#289560: acknowledged by developer (Bug#289560: fixed in vim 1:6.3-058+1)

--+g7M9IMkV8truYOl
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Hi Javier!

Javier Fern=E1ndez-Sanguino Pe=F1a [2005-01-19  9:08 +0100]:
> >    * added a new patch (stolen from Ubuntu) which modifies vimspell.sh =
and
> >      tcltags.sh so they use mktemp instead of insecure $$ construction =
to
> >      create temporary files (CAN-2005-0069) (closes: #289560)
>=20
> A few comments and questions regarding this entry:
>=20
> - the scripts seem to be ancient and no longer supported by either their=
=20
> authors nor vim maintainer and have been removed upstream.