vulnerability: rewrite arbitrary user file

[Vasily Kulikov]

Binary package hint: aptitude

Hi, I've just discovered that aptitude is vulnerable to rewriting any user (maybe root) file:

bool hier_editor::handle_key(const cw::config::key &k)
...
      if(homedir.empty())
 {
...
   cfgfile = "/tmp/function_pkgs";
 }
...
      save_hier(cfgfile);

Here attacker can create link to any file in the system that user may write to. If process has no $HOME set, this file would be overwritten.

It is rare that $HOME is null, but it such rare case it is vulnerable.

Thanks.

[Kees Cook (kees)]

Thanks for taking the time to report this bug and helping to make Ubuntu better.

The latest release of Ubuntu is not vulnerable to symlink race attacks, but earlier releases will need fixing. https://wiki.ubuntu.com/Security/Features#symlink

Since this code is extremely hard to hit, I'm setting the priority to "Low".

[Jamie Strandboge (jdstrand)]

This was fixed in Debian with 0.6.3-4.

[Brian Murray (brian-murray)]

According to the Debian bug report this was fixed in aptitude version 0.6.3-4 which is in Oneiric so I am marking this as Fix Released.