Ubuntu
debconf package

  1. Bug #2043711
  2. Comment #5

Comment 5 for bug 2043711

Revision history for this message
Alex Murray (alexmurray) wrote : Re: Open3.pm tries to run code in /tmp when updating ubuntu-drivers-common

I am struggling to see the vulnerability here still - the path used in this case is /tmp/ubuntu-drivers-common.config.55GJ8b appears to have a randomly generated suffix and so couldn't have been guessed beforehand nor preseeded with other contents by a local attacker - so the only way then that I can see that this could be a vulnerability would be if this file was world-writable - but it is not clear that this is the case either.

Assuming this file comes from debconf, from what I can see in its sources, it creates temporary files via the https://perldoc.perl.org/File::Temp package - which states that files are created with permissions 0600 by default too.