Temporary file vulnerability in euca_conf

[Colin Watson]

euca_conf handles its temporary files insecurely:

# 3 paramenter: the file, the variable name, the new value
change_var_value () {
        check_and_backup $1
        cp $1 /tmp/euca-tmp.$$
        sed "s<^[[:blank:]#]*\(${2}\).*<\1=\"${3}\"<" /tmp/euca-tmp.$$ > $1
        rm -f /tmp/euca-tmp.$$
}
# comment lines matching $2 ($1 is the file)
comment () {
        check_and_backup $1
        cp $1 /tmp/euca-tmp.$$
        sed "s<^[[:blank:]]*\(${2}.*\)<#\1<" /tmp/euca-tmp.$$ > $1
        rm -f /tmp/euca-tmp.$$
}
# comment lines matching $2 ($1 is the file)
uncomment () {
        check_and_backup $1
        cp $1 /tmp/euca-tmp.$$
        sed "s<^[#[:blank:]]*\(${2}.*\)<\1<" /tmp/euca-tmp.$$ > $1
        rm -f /tmp/euca-tmp.$$
}

[Launchpad Janitor (janitor)]

This bug was fixed in the package eucalyptus - 1.6~bzr672-0ubuntu3

---------------
eucalyptus (1.6~bzr672-0ubuntu3) karmic; urgency=low

  [ Colin Watson ]
  * Add euca_conf --discover-nodes option.
  * Register cluster with local cloud in start as well as cleanstart.
  * SECURITY UPDATE: Fix temporary file vulnerability in euca_conf by using
    'sed -i' (LP: #424459).

  [ Soren Hansen ]
  * Only ship antlr.jar in eucalyptus-java-common. (LP: #429086)

 -- Soren Hansen <email address hidden> Mon, 14 Sep 2009 12:59:40 +0200