Bug #20127 “lm-sensors: Insecure tempfile usage in pwmconfig” : Bugs : lm-sensors package : Ubuntu

Revision history for this message

Debian Bug Importer (debzilla) wrote on 2005-08-20:

#1

Automatically imported from Debian bug report #324193 http://bugs.debian.org/324193

Revision history for this message

Debian Bug Importer (debzilla) wrote on 2005-08-20:

#2

Message-Id: <email address hidden>
Date: Sat, 20 Aug 2005 22:21:13 +0200
From: Aurelien Jarno <email address hidden>
To: Debian Bug Tracking System <email address hidden>
Subject: lm-sensors: Insecure tempfile usage in pwmconfig

Package: lm-sensors
Version: 1:2.9.1-5
Severity: grave
Tags: security patch

lm-sensors's configuration script pwmconfig, which is used, generally as
root, to probe the fan controls and generate a new configuration file,
uses files under /tmp in an unsafe way which makes it possible to
conduct symlink attacks. The temporary filename used to create a
temporary configuration file is hardcoded to '/tmp/fancontrol'.

Thanks to Javier Fernández-Sanguino Peña <email address hidden> who first
reported me the bug.

--- pwmconfig.orig 2005-08-05 18:36:40.000000000 +0200
+++ pwmconfig 2005-08-05 18:37:47.000000000 +0200
@@ -465,9 +465,11 @@
function SaveConfig {
  echo
  echo "Saving configuration to $FCCONFIG..."
- egrep -v '(INTERVAL|FCTEMPS|FCFANS|MAXTEMP|MINTEMP|MINSTART|MINSTOP)' $FCCONFIG >/tmp/fancontrol
- echo -e "INTERVAL=$INTERVAL\nFCTEMPS=$FCTEMPS\nFCFANS=$FCFANS\nMINTEMP=$MINTEMP\nMAXTEMP=$MAXTEMP\nMINSTART=$MINSTART\nMINSTOP=$MINSTOP" >>/tmp/fancontrol
- mv /tmp/fancontrol $FCCONFIG
+ tmpfile=`tempfile` || { echo "$0: Cannot create temporary file" >&2; exit 1; }
+ trap " [ -f \"$tmpfile\" ] && /bin/rm -f -- \"$tmpfile\"" 0 1 2 3 13 15
+ egrep -v '(INTERVAL|FCTEMPS|FCFANS|MAXTEMP|MINTEMP|MINSTART|MINSTOP)' $FCCONFIG >$tmpfile
+ echo -e "INTERVAL=$INTERVAL\nFCTEMPS=$FCTEMPS\nFCFANS=$FCFANS\nMINTEMP=$MINTEMP\nMAXTEMP=$MAXTEMP\nMINSTART=$MINSTART\nMINSTOP=$MINSTOP" >>$tmpfile
+ mv $tmpfile $FCCONFIG
  #check if file was written correctly
  echo 'Configuration saved'
}

-- System Information:
Debian Release: testing/unstable
APT prefers unstable
APT policy: (500, 'unstable')
Architecture: i386 (i686)
Shell: /bin/sh linked to /bin/bash
Kernel: Linux 2.6.12
Locale: LANG=fr_FR.UTF-8, LC_CTYPE=fr_FR.UTF-8 (charmap=UTF-8) (ignored: LC_ALL set to fr_FR.UTF-8)

Versions of packages lm-sensors depends on:
ii debconf [debconf-2.0] 1.4.57 Debian configuration management sy
ii libc6 2.3.5-3 GNU C Library: Shared libraries an
ii libsensors3 1:2.9.1-5 library to read temperature/voltag
ii makedev 2.3.1-78 creates device files in /dev
ii perl 5.8.7-4 Larry Wall's Practical Extraction
ii sed 4.1.4-2 The GNU sed stream editor
ii sysvinit 2.86.ds1-1 System-V like init
ii ucf 2.001 Update Configuration File: preserv

Versions of packages lm-sensors recommends:
ii kernel-image-2.6.12 [kernel 10.00.Custom Linux kernel binary image for vers
ii lm-sensors-2.4.27-2-k7 [lm- 1:2.9.1-5 kernel drivers to read temperature

-- debconf information excluded

Message-Id: <E1E6Zq5-0007jl-CY@bode.aurel32.net>
Date: Sat, 20 Aug 2005 22:21:13 +0200
From: Aurelien Jarno <aurel32@debian.org>
To: Debian Bug Tracking System <submit@bugs.debian.org>
Subject: lm-sensors: Insecure tempfile usage in pwmconfig

Package: lm-sensors
Version: 1:2.9.1-5
Severity: grave
Tags: security patch

lm-sensors's configuration script pwmconfig, which is used, generally as
root, to probe the fan controls and generate a new configuration file,
uses files under /tmp in an unsafe way which makes it possible to
conduct symlink attacks. The temporary filename used to create a
temporary configuration file is hardcoded to '/tmp/fancontrol'.

Thanks to Javier Fernández-Sanguino Peña <jfs@computer.org> who first
reported me the bug.

--- pwmconfig.orig	2005-08-05 18:36:40.000000000 +0200
+++ pwmconfig	2005-08-05 18:37:47.000000000 +0200
@@ -465,9 +465,11 @@
 function SaveConfig {
 	echo
 	echo "Saving configuration to $FCCONFIG..."
-	egrep -v '(INTERVAL|FCTEMPS|FCFANS|MAXTEMP|MINTEMP|MINSTART|MINSTOP)' $FCCONFIG >/tmp/fancontrol
-	echo -e "INTERVAL=$INTERVAL\nFCTEMPS=$FCTEMPS\nFCFANS=$FCFANS\nMINTEMP=$MINTEMP\nMAXTEMP=$MAXTEMP\nMINSTART=$MINSTART\nMINSTOP=$MINSTOP" >>/tmp/fancontrol
-	mv /tmp/fancontrol $FCCONFIG
+	tmpfile=`tempfile` || { echo "$0: Cannot create temporary file" >&2; exit 1;  }
+	trap " [ -f \"$tmpfile\" ] && /bin/rm -f -- \"$tmpfile\"" 0 1 2 3 13 15
+	egrep -v '(INTERVAL|FCTEMPS|FCFANS|MAXTEMP|MINTEMP|MINSTART|MINSTOP)' $FCCONFIG >$tmpfile
+	echo -e "INTERVAL=$INTERVAL\nFCTEMPS=$FCTEMPS\nFCFANS=$FCFANS\nMINTEMP=$MINTEMP\nMAXTEMP=$MAXTEMP\nMINSTART=$MINSTART\nMINSTOP=$MINSTOP" >>$tmpfile
+	mv $tmpfile $FCCONFIG
 	#check if file was written correctly
 	echo 'Configuration saved'
 }

-- System Information:
Debian Release: testing/unstable
  APT prefers unstable
  APT policy: (500, 'unstable')
Architecture: i386 (i686)
Shell:  /bin/sh linked to /bin/bash
Kernel: Linux 2.6.12
Locale: LANG=fr_FR.UTF-8, LC_CTYPE=fr_FR.UTF-8 (charmap=UTF-8) (ignored: LC_ALL set to fr_FR.UTF-8)

Versions of packages lm-sensors depends on:
ii  debconf [debconf-2.0]         1.4.57     Debian configuration management sy
ii  libc6                         2.3.5-3    GNU C Library: Shared libraries an
ii  libsensors3                   1:2.9.1-5  library to read temperature/voltag
ii  makedev                       2.3.1-78   creates device files in /dev
ii  perl                          5.8.7-4    Larry Wall's Practical Extraction 
ii  sed                           4.1.4-2    The GNU sed stream editor
ii  sysvinit                      2.86.ds1-1 System-V like init
ii  ucf                           2.001      Update Configuration File: preserv

Versions of packages lm-sensors recommends:
ii  kernel-image-2.6.12 [kernel 10.00.Custom Linux kernel binary image for vers
ii  lm-sensors-2.4.27-2-k7 [lm- 1:2.9.1-5    kernel drivers to read temperature

-- debconf information excluded

Revision history for this message

Matt Zimmerman (mdz) wrote on 2005-08-20:

#3

I thought this binary package was in universe, but apparently not...please look
into that as well

Revision history for this message

In Debian Bug tracker #324193, Aurelien Jarno (aurel32) wrote on 2005-08-21: Bug#324193: fixed in lm-sensors 1:2.9.1-7

#4

Download full text (7.5 KiB)

Source: lm-sensors
Source-Version: 1:2.9.1-7

We believe that the bug you reported is fixed in the latest version of
lm-sensors, which is due to be installed in the Debian FTP archive:

kernel-patch-2.4-lm-sensors_2.9.1-7_all.deb
  to pool/main/l/lm-sensors/kernel-patch-2.4-lm-sensors_2.9.1-7_all.deb
libsensors-dev_2.9.1-7_hppa.deb
  to pool/main/l/lm-sensors/libsensors-dev_2.9.1-7_hppa.deb
libsensors-dev_2.9.1-7_i386.deb
  to pool/main/l/lm-sensors/libsensors-dev_2.9.1-7_i386.deb
libsensors-dev_2.9.1-7_mips.deb
  to pool/main/l/lm-sensors/libsensors-dev_2.9.1-7_mips.deb
libsensors-dev_2.9.1-7_powerpc.deb
  to pool/main/l/lm-sensors/libsensors-dev_2.9.1-7_powerpc.deb
libsensors-dev_2.9.1-7_sparc.deb
  to pool/main/l/lm-sensors/libsensors-dev_2.9.1-7_sparc.deb
libsensors3_2.9.1-7_hppa.deb
  to pool/main/l/lm-sensors/libsensors3_2.9.1-7_hppa.deb
libsensors3_2.9.1-7_i386.deb
  to pool/main/l/lm-sensors/libsensors3_2.9.1-7_i386.deb
libsensors3_2.9.1-7_mips.deb
  to pool/main/l/lm-sensors/libsensors3_2.9.1-7_mips.deb
libsensors3_2.9.1-7_powerpc.deb
  to pool/main/l/lm-sensors/libsensors3_2.9.1-7_powerpc.deb
libsensors3_2.9.1-7_sparc.deb
  to pool/main/l/lm-sensors/libsensors3_2.9.1-7_sparc.deb
lm-sensors-2.4.27-2-386_2.9.1-7_i386.deb
  to pool/main/l/lm-sensors/lm-sensors-2.4.27-2-386_2.9.1-7_i386.deb
lm-sensors-2.4.27-2-586tsc_2.9.1-7_i386.deb
  to pool/main/l/lm-sensors/lm-sensors-2.4.27-2-586tsc_2.9.1-7_i386.deb
lm-sensors-2.4.27-2-686-smp_2.9.1-7_i386.deb
  to pool/main/l/lm-sensors/lm-sensors-2.4.27-2-686-smp_2.9.1-7_i386.deb
lm-sensors-2.4.27-2-686_2.9.1-7_i386.deb
  to pool/main/l/lm-sensors/lm-sensors-2.4.27-2-686_2.9.1-7_i386.deb
lm-sensors-2.4.27-2-k6_2.9.1-7_i386.deb
  to pool/main/l/lm-sensors/lm-sensors-2.4.27-2-k6_2.9.1-7_i386.deb
lm-sensors-2.4.27-2-k7-smp_2.9.1-7_i386.deb
  to pool/main/l/lm-sensors/lm-sensors-2.4.27-2-k7-smp_2.9.1-7_i386.deb
lm-sensors-2.4.27-2-k7_2.9.1-7_i386.deb
  to pool/main/l/lm-sensors/lm-sensors-2.4.27-2-k7_2.9.1-7_i386.deb
lm-sensors-source_2.9.1-7_all.deb
  to pool/main/l/lm-sensors/lm-sensors-source_2.9.1-7_all.deb
lm-sensors_2.9.1-7.diff.gz
  to pool/main/l/lm-sensors/lm-sensors_2.9.1-7.diff.gz
lm-sensors_2.9.1-7.dsc
  to pool/main/l/lm-sensors/lm-sensors_2.9.1-7.dsc
lm-sensors_2.9.1-7_hppa.deb
  to pool/main/l/lm-sensors/lm-sensors_2.9.1-7_hppa.deb
lm-sensors_2.9.1-7_i386.deb
  to pool/main/l/lm-sensors/lm-sensors_2.9.1-7_i386.deb
lm-sensors_2.9.1-7_mips.deb
  to pool/main/l/lm-sensors/lm-sensors_2.9.1-7_mips.deb
lm-sensors_2.9.1-7_powerpc.deb
  to pool/main/l/lm-sensors/lm-sensors_2.9.1-7_powerpc.deb
lm-sensors_2.9.1-7_sparc.deb
  to pool/main/l/lm-sensors/lm-sensors_2.9.1-7_sparc.deb
sensord_2.9.1-7_hppa.deb
  to pool/main/l/lm-sensors/sensord_2.9.1-7_hppa.deb
sensord_2.9.1-7_i386.deb
  to pool/main/l/lm-sensors/sensord_2.9.1-7_i386.deb
sensord_2.9.1-7_mips.deb
  to pool/main/l/lm-sensors/sensord_2.9.1-7_mips.deb
sensord_2.9.1-7_powerpc.deb
  to pool/main/l/lm-sensors/sensord_2.9.1-7_powerpc.deb
sensord_2.9.1-7_sparc.deb
  to pool/main/l/lm-sensors/sensord_2.9.1-7_sparc.deb

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will ...

Source: lm-sensors
Source-Version: 1:2.9.1-7

We believe that the bug you reported is fixed in the latest version of
lm-sensors, which is due to be installed in the Debian FTP archive:

kernel-patch-2.4-lm-sensors_2.9.1-7_all.deb
  to pool/main/l/lm-sensors/kernel-patch-2.4-lm-sensors_2.9.1-7_all.deb
libsensors-dev_2.9.1-7_hppa.deb
  to pool/main/l/lm-sensors/libsensors-dev_2.9.1-7_hppa.deb
libsensors-dev_2.9.1-7_i386.deb
  to pool/main/l/lm-sensors/libsensors-dev_2.9.1-7_i386.deb
libsensors-dev_2.9.1-7_mips.deb
  to pool/main/l/lm-sensors/libsensors-dev_2.9.1-7_mips.deb
libsensors-dev_2.9.1-7_powerpc.deb
  to pool/main/l/lm-sensors/libsensors-dev_2.9.1-7_powerpc.deb
libsensors-dev_2.9.1-7_sparc.deb
  to pool/main/l/lm-sensors/libsensors-dev_2.9.1-7_sparc.deb
libsensors3_2.9.1-7_hppa.deb
  to pool/main/l/lm-sensors/libsensors3_2.9.1-7_hppa.deb
libsensors3_2.9.1-7_i386.deb
  to pool/main/l/lm-sensors/libsensors3_2.9.1-7_i386.deb
libsensors3_2.9.1-7_mips.deb
  to pool/main/l/lm-sensors/libsensors3_2.9.1-7_mips.deb
libsensors3_2.9.1-7_powerpc.deb
  to pool/main/l/lm-sensors/libsensors3_2.9.1-7_powerpc.deb
libsensors3_2.9.1-7_sparc.deb
  to pool/main/l/lm-sensors/libsensors3_2.9.1-7_sparc.deb
lm-sensors-2.4.27-2-386_2.9.1-7_i386.deb
  to pool/main/l/lm-sensors/lm-sensors-2.4.27-2-386_2.9.1-7_i386.deb
lm-sensors-2.4.27-2-586tsc_2.9.1-7_i386.deb
  to pool/main/l/lm-sensors/lm-sensors-2.4.27-2-586tsc_2.9.1-7_i386.deb
lm-sensors-2.4.27-2-686-smp_2.9.1-7_i386.deb
  to pool/main/l/lm-sensors/lm-sensors-2.4.27-2-686-smp_2.9.1-7_i386.deb
lm-sensors-2.4.27-2-686_2.9.1-7_i386.deb
  to pool/main/l/lm-sensors/lm-sensors-2.4.27-2-686_2.9.1-7_i386.deb
lm-sensors-2.4.27-2-k6_2.9.1-7_i386.deb
  to pool/main/l/lm-sensors/lm-sensors-2.4.27-2-k6_2.9.1-7_i386.deb
lm-sensors-2.4.27-2-k7-smp_2.9.1-7_i386.deb
  to pool/main/l/lm-sensors/lm-sensors-2.4.27-2-k7-smp_2.9.1-7_i386.deb
lm-sensors-2.4.27-2-k7_2.9.1-7_i386.deb
  to pool/main/l/lm-sensors/lm-sensors-2.4.27-2-k7_2.9.1-7_i386.deb
lm-sensors-source_2.9.1-7_all.deb
  to pool/main/l/lm-sensors/lm-sensors-source_2.9.1-7_all.deb
lm-sensors_2.9.1-7.diff.gz
  to pool/main/l/lm-sensors/lm-sensors_2.9.1-7.diff.gz
lm-sensors_2.9.1-7.dsc
  to pool/main/l/lm-sensors/lm-sensors_2.9.1-7.dsc
lm-sensors_2.9.1-7_hppa.deb
  to pool/main/l/lm-sensors/lm-sensors_2.9.1-7_hppa.deb
lm-sensors_2.9.1-7_i386.deb
  to pool/main/l/lm-sensors/lm-sensors_2.9.1-7_i386.deb
lm-sensors_2.9.1-7_mips.deb
  to pool/main/l/lm-sensors/lm-sensors_2.9.1-7_mips.deb
lm-sensors_2.9.1-7_powerpc.deb
  to pool/main/l/lm-sensors/lm-sensors_2.9.1-7_powerpc.deb
lm-sensors_2.9.1-7_sparc.deb
  to pool/main/l/lm-sensors/lm-sensors_2.9.1-7_sparc.deb
sensord_2.9.1-7_hppa.deb
  to pool/main/l/lm-sensors/sensord_2.9.1-7_hppa.deb
sensord_2.9.1-7_i386.deb
  to pool/main/l/lm-sensors/sensord_2.9.1-7_i386.deb
sensord_2.9.1-7_mips.deb
  to pool/main/l/lm-sensors/sensord_2.9.1-7_mips.deb
sensord_2.9.1-7_powerpc.deb
  to pool/main/l/lm-sensors/sensord_2.9.1-7_powerpc.deb
sensord_2.9.1-7_sparc.deb
  to pool/main/l/lm-sensors/sensord_2.9.1-7_sparc.deb

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 324193@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Aurelien Jarno <aurel32@debian.org> (supplier of updated lm-sensors package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.7
Date: Sat, 20 Aug 2005 22:12:54 +0200
Source: lm-sensors
Binary: lm-sensors-2.4.27-2-386 lm-sensors-source lm-sensors-2.4.27-2-k7 libsensors-dev lm-sensors-2.4.27-2-k7-smp lm-sensors-2.4.27-2-586tsc lm-sensors sensord kernel-patch-2.4-lm-sensors lm-sensors-2.4.27-2-686 lm-sensors-2.4.27-2-k6 lm-sensors-2.4.27-2-686-smp libsensors3
Architecture: all hppa i386 mips powerpc source sparc 
Version: 1:2.9.1-7
Distribution: unstable
Urgency: high
Maintainer: Aurelien Jarno <aurel32@debian.org>
Changed-By: Aurelien Jarno <aurel32@debian.org>
Description: 
 libsensors-dev - lm-sensors development kit
 libsensors3 - library to read temperature/voltage/fan sensors
 lm-sensors - utilities to read temperature/voltage/fan sensors
 sensord    - hardware sensor information logging daemon
Closes: 324193
Changes: 
 lm-sensors (1:2.9.1-7) unstable; urgency=high
 .
   * Urgency set to high due to security fix.
   * Fixed and insecure tempfile usage in pwmconfig. Thanks to Javier
     FernÃ¡ndez-Sanguino PeÃ±a <jfs@computer.org> for the bug report and the
     patch (closes: bug#324193).
Files: 
 0516aaf8e29df8c9649895b4172823ef 258084 utils extra lm-sensors-2.4.27-2-386_2.9.1-7_i386.deb
 0585b3d2ac5e5606097833356767f1f7 941732 misc extra lm-sensors-source_2.9.1-7_all.deb
 0aa708156bb116d038268c1968e54f00 1086 utils extra lm-sensors_2.9.1-7.dsc
 1787514e5eb011bc4c20274fc963b5d5 107066 libdevel extra libsensors-dev_2.9.1-7_powerpc.deb
 1e62f1a2097bee1ebf426d8f381af6fa 258026 utils extra lm-sensors-2.4.27-2-586tsc_2.9.1-7_i386.deb
 210ffba71baecdf9813d250a4548a2b1 474082 utils extra lm-sensors_2.9.1-7_hppa.deb
 36c2b2092c0a7aeb6993b3e4cb9bebff 100668 libdevel extra libsensors-dev_2.9.1-7_sparc.deb
 493108678d39c69d36345a4825cfcd39 304740 devel extra kernel-patch-2.4-lm-sensors_2.9.1-7_all.deb
 4fac1b4f1e79e9c4ccfa65f5478d67bd 33521 utils extra lm-sensors_2.9.1-7.diff.gz
 6aa7e28a0349ae4c107c84aa08e11ffa 258104 utils extra lm-sensors-2.4.27-2-k6_2.9.1-7_i386.deb
 72fe5179b837f867deb3c8bf2f86155c 469182 utils extra lm-sensors_2.9.1-7_i386.deb
 748e4a1ada4ab6a3919d1b5eff45b9dd 471554 utils extra lm-sensors_2.9.1-7_powerpc.deb
 798123a11b44866e257a2fcad8b898ca 258518 utils extra lm-sensors-2.4.27-2-686-smp_2.9.1-7_i386.deb
 7a4b6e65ab67b821ca5126f4224cb4a2 59448 utils extra sensord_2.9.1-7_hppa.deb
 840e4b15760ea78e1504a674c9eae9fd 258856 utils extra lm-sensors-2.4.27-2-k7-smp_2.9.1-7_i386.deb
 9164834eca8b10bb84f5c63904fa4394 469068 utils extra lm-sensors_2.9.1-7_mips.deb
 9c5bed74ce03f94e5ce7ae1908e15386 93186 libdevel extra libsensors-dev_2.9.1-7_i386.deb
 a19218e71ef3fe21df879496fe84f29a 82132 libs optional libsensors3_2.9.1-7_mips.deb
 ae355a7965b87190c50e7288bfce1398 77504 libs optional libsensors3_2.9.1-7_i386.deb
 b46c41f23141c6f79a62977cce90fd60 467912 utils extra lm-sensors_2.9.1-7_sparc.deb
 c678a0c2e5a21b8e245b0c9b0e91d2bc 59266 utils extra sensord_2.9.1-7_mips.deb
 cab3debe919916b807439a65294d4173 258368 utils extra lm-sensors-2.4.27-2-k7_2.9.1-7_i386.deb
 d04b1103cb3fb687cf1a5a962c3754e9 56180 utils extra sensord_2.9.1-7_i386.deb
 da4616930c9a272b87d4660bb955c6c5 56872 utils extra sensord_2.9.1-7_sparc.deb
 dbc952fa5d0e1a3320afa93e593f2a39 85302 libs optional libsensors3_2.9.1-7_powerpc.deb
 dd2adf9e678fdab7e7f1dbaca3173b44 81968 libs optional libsensors3_2.9.1-7_sparc.deb
 e260695ab74bd63805dc016441fed720 103650 libdevel extra libsensors-dev_2.9.1-7_mips.deb
 e38912090e5083e8f2f320d9b66f1275 104894 libdevel extra libsensors-dev_2.9.1-7_hppa.deb
 ec9414cc5fe31750d1ac6eb77bcf04a8 258078 utils extra lm-sensors-2.4.27-2-686_2.9.1-7_i386.deb
 f4fdf9a4e6730892154e7dadcf668703 89014 libs optional libsensors3_2.9.1-7_hppa.deb
 fe6f24f759921708b42d03e987a716d2 59310 utils extra sensord_2.9.1-7_powerpc.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQFDB8Yww3ao2vG823MRAo0XAJ90DZfFg6t7eyXJcZ/MCdrO/OIUlwCfbkPS
mwy8X0LTERAkDvBFava7a3E=
=lk2F
-----END PGP SIGNATURE-----

Revision history for this message

In Debian Bug tracker #324193, Aurelien Jarno (aurelien-aurel32) wrote on 2005-08-21: Reopening the bug for sarge and etch

#5

reopen 324193
tag 324193 + sarge
tag 324193 + etch
thanks

--
.''`. Aurelien Jarno | GPG: 1024D/F1BCDB73
: :' : Debian GNU/Linux developer | Electrical Engineer
`. `' <email address hidden> | <email address hidden>
`- people.debian.org/~aurel32 | www.aurel32.net

Revision history for this message

Martin Pitt (pitti) wrote on 2005-08-23:

#6

lm-sensors (1:2.9.1-4ubuntu2) breezy; urgency=low
.
   * SECURITY UPDATE: Fix insecure temporary file handling.
   * prog/pwm/pwmconfig:
     - Do not use hardcoded /tmp/fancontrol, but safe temporary name generated
       by tempfile.
     - Ubuntu #13887, Debian #324193

Fix pending for Hoary.

Revision history for this message

Martin Pitt (pitti) wrote on 2005-08-23:

#7

Hoary fixed in USN-172-1, lm-sensors is universe for Warty.

Revision history for this message

In Debian Bug tracker #324193, Martin Pitt (pitti) wrote on 2005-08-24: Fwd: CAN-2005-2672 assigned to pwmconfig symlink

#8

Hi!

This got a CAN number assigned. Can you please mention it in the
changelog when you fix this?

Thanks,

Martin

----- Forwarded message from "Steven M. Christey" <email address hidden> -----

Date: Tue, 23 Aug 2005 14:53:06 -0400 (EDT)
From: "Steven M. Christey" <email address hidden>
To: <email address hidden>, <email address hidden>
Cc: <email address hidden>
Subject: CAN-2005-2672 assigned to pwmconfig symlink
X-Spam-Status: No, score=1.4 required=4.0 tests=AWL,BAYES_50 autolearn=no
version=3.0.3

FYI...

======================================================
Candidate: CAN-2005-2672
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2672
Reference: BID:14624
Reference: URL:http://www.securityfocus.com/bid/14624
Reference: UBUNTU:USN-172-1
Reference: URL:http://www.ubuntulinux.org/support/documentation/usn/usn-172-1
Reference: CONFIRM:http://secure.netroedge.com/~lm78/cvs/lm_sensors2/CHANGES

pwmconfig in LM_sensors before 2.9.1 creates temporary files
insecurely, which allows local users to overwrite arbitrary files via
a symlink attack on the fancontrol temporary file.

----- End forwarded message -----

--
Martin Pitt http://www.piware.de
Ubuntu Developer http://www.ubuntu.com
Debian Developer http://www.debian.org

Revision history for this message

In Debian Bug tracker #324193, Aurelien Jarno (aurelien-aurel32) wrote on 2005-08-24: Re: Bug#324193: Fwd: CAN-2005-2672 assigned to pwmconfig symlink

#9

On Wed, Aug 24, 2005 at 08:47:53AM +0200, Martin Pitt wrote:
> Hi!
>
> This got a CAN number assigned. Can you please mention it in the
> changelog when you fix this?

Well, the bug is now fixed for a few days. I have decided to fix it
without a CAN number because I was unable to get one (got no answer from
the security team, and it is still the case).

Should I upload a new version, just adding this CAN number.

Bye,
Aurelien

--
.''`. Aurelien Jarno | GPG: 1024D/F1BCDB73
: :' : Debian GNU/Linux developer | Electrical Engineer
`. `' <email address hidden> | <email address hidden>
`- people.debian.org/~aurel32 | www.aurel32.net

Revision history for this message

In Debian Bug tracker #324193, Martin Pitt (pitti) wrote on 2005-08-24:

#10

Hi Aurelien!

Aurelien Jarno [2005-08-24 11:10 +0200]:
> On Wed, Aug 24, 2005 at 08:47:53AM +0200, Martin Pitt wrote:
> > Hi!
> >
> > This got a CAN number assigned. Can you please mention it in the
> > changelog when you fix this?
>
> Well, the bug is now fixed for a few days. I have decided to fix it
> without a CAN number because I was unable to get one (got no answer from
> the security team, and it is still the case).

Ah, fine.

> Should I upload a new version, just adding this CAN number.

No, that's not worth the trouble. However, it would be nice if you
could add it at the next regular upload.

Thanks!

Martin
--
Martin Pitt http://www.piware.de
Ubuntu Developer http://www.ubuntu.com
Debian Developer http://www.debian.org

Revision history for this message

In Debian Bug tracker #324193, Martin Schulze (joey-infodrom) wrote on 2005-09-15: Fixed in NMU of lm-sensors 1:2.9.1-1sarge2

#11

tag 324193 + fixed

quit

This message was generated automatically in response to a
non-maintainer upload. The .changes file follows.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.7
Date: Mon, 12 Sep 2005 09:13:40 +0200
Source: lm-sensors
Binary: lm-sensors-2.4.27-2-386 lm-sensors-source lm-sensors-2.4.27-2-k7 libsensors-dev lm-sensors-2.4.27-2-k7-smp lm-sensors-2.4.27-2-586tsc lm-sensors sensord kernel-patch-2.4-lm-sensors lm-sensors-2.4.27-2-686 lm-sensors-2.4.27-2-k6 lm-sensors-2.4.27-2-686-smp libsensors3
Architecture: source powerpc all
Version: 1:2.9.1-1sarge2
Distribution: stable-security
Urgency: high
Maintainer: Martin Schulze <email address hidden>
Changed-By: Martin Schulze <email address hidden>
Description:
kernel-patch-2.4-lm-sensors - drivers to read temperature/voltage/fan sensors
libsensors-dev - lm-sensors development kit
libsensors3 - library to read temperature/voltage/fan sensors
lm-sensors - utilities to read temperature/voltage/fan sensors
lm-sensors-source - kernel drivers to read temperature/voltage/fan sensors (source)
sensord - hardware sensor information logging daemon
Closes: 324193
Changes:
lm-sensors (1:2.9.1-1sarge2) stable-security; urgency=high
.
   * Non-maintainer upload by the Security Team
   * Applied maintainer patch to fix insecure temporary file creation
     [prog/pwm/pwmconfig, CAN-2005-2672], Closes: Bug#324193
Files:
b29b66e67c0cdc230e00e5183724427a 1089 utils extra lm-sensors_2.9.1-1sarge2.dsc
551c338fbc31a17f7fd909c8c18f495e 32896 utils extra lm-sensors_2.9.1-1sarge2.diff.gz
326fe3274869079637c4a425430d9cc9 476730 utils extra lm-sensors_2.9.1-1sarge2_powerpc.deb
362b899e12a413c46a1aa3bb80ae9564 84122 libs optional libsensors3_2.9.1-1sarge2_powerpc.deb
1c01fa48983ca51785fb6cebcb1352e7 105926 libdevel extra libsensors-dev_2.9.1-1sarge2_powerpc.deb
2be27fc39b66107b8bc28df51bfd929f 59362 utils extra sensord_2.9.1-1sarge2_powerpc.deb
9b936604bcb60dd90c26de965bc8ae7f 304604 devel extra kernel-patch-2.4-lm-sensors_2.9.1-1sarge2_all.deb
a4cc7cf62245912cca061249e7ff153e 956166 misc extra lm-sensors-source_2.9.1-1sarge2_all.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQFDJTECW5ql+IAeqTIRAuYEAKCD8P/umMhut8akP+7w4TF+B64QwACfW9p8
uH1Yn+P/8dLaOiF2Utez5nk=
=Q2Di
-----END PGP SIGNATURE-----

tag 324193 + fixed

quit

This message was generated automatically in response to a
non-maintainer upload.  The .changes file follows.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.7
Date: Mon, 12 Sep 2005 09:13:40 +0200
Source: lm-sensors
Binary: lm-sensors-2.4.27-2-386 lm-sensors-source lm-sensors-2.4.27-2-k7 libsensors-dev lm-sensors-2.4.27-2-k7-smp lm-sensors-2.4.27-2-586tsc lm-sensors sensord kernel-patch-2.4-lm-sensors lm-sensors-2.4.27-2-686 lm-sensors-2.4.27-2-k6 lm-sensors-2.4.27-2-686-smp libsensors3
Architecture: source powerpc all
Version: 1:2.9.1-1sarge2
Distribution: stable-security
Urgency: high
Maintainer: Martin Schulze <joey@debian.org>
Changed-By: Martin Schulze <joey@infodrom.org>
Description: 
 kernel-patch-2.4-lm-sensors - drivers to read temperature/voltage/fan sensors
 libsensors-dev - lm-sensors development kit
 libsensors3 - library to read temperature/voltage/fan sensors
 lm-sensors - utilities to read temperature/voltage/fan sensors
 lm-sensors-source - kernel drivers to read temperature/voltage/fan sensors (source)
 sensord    - hardware sensor information logging daemon
Closes: 324193
Changes: 
 lm-sensors (1:2.9.1-1sarge2) stable-security; urgency=high
 .
   * Non-maintainer upload by the Security Team
   * Applied maintainer patch to fix insecure temporary file creation
     [prog/pwm/pwmconfig, CAN-2005-2672], Closes: Bug#324193
Files: 
 b29b66e67c0cdc230e00e5183724427a 1089 utils extra lm-sensors_2.9.1-1sarge2.dsc
 551c338fbc31a17f7fd909c8c18f495e 32896 utils extra lm-sensors_2.9.1-1sarge2.diff.gz
 326fe3274869079637c4a425430d9cc9 476730 utils extra lm-sensors_2.9.1-1sarge2_powerpc.deb
 362b899e12a413c46a1aa3bb80ae9564 84122 libs optional libsensors3_2.9.1-1sarge2_powerpc.deb
 1c01fa48983ca51785fb6cebcb1352e7 105926 libdevel extra libsensors-dev_2.9.1-1sarge2_powerpc.deb
 2be27fc39b66107b8bc28df51bfd929f 59362 utils extra sensord_2.9.1-1sarge2_powerpc.deb
 9b936604bcb60dd90c26de965bc8ae7f 304604 devel extra kernel-patch-2.4-lm-sensors_2.9.1-1sarge2_all.deb
 a4cc7cf62245912cca061249e7ff153e 956166 misc extra lm-sensors-source_2.9.1-1sarge2_all.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQFDJTECW5ql+IAeqTIRAuYEAKCD8P/umMhut8akP+7w4TF+B64QwACfW9p8
uH1Yn+P/8dLaOiF2Utez5nk=
=Q2Di
-----END PGP SIGNATURE-----

Revision history for this message

In Debian Bug tracker #324193, Aurelien Jarno (aurelien-aurel32) wrote on 2005-09-15: bug only present in etch

#12

tag 324193 - sarge
tag 324193 - fixed
thanks

--
.''`. Aurelien Jarno | GPG: 1024D/F1BCDB73
: :' : Debian GNU/Linux developer | Electrical Engineer
`. `' <email address hidden> | <email address hidden>
`- people.debian.org/~aurel32 | www.aurel32.net

Revision history for this message

Debian Bug Importer (debzilla) wrote on 2005-09-22:

#13

Download full text (7.7 KiB)

Message-Id: <email address hidden>
Date: Sat, 20 Aug 2005 17:17:06 -0700
From: Aurelien Jarno <email address hidden>
To: <email address hidden>
Subject: Bug#324193: fixed in lm-sensors 1:2.9.1-7

Source: lm-sensors
Source-Version: 1:2.9.1-7

We believe that the bug you reported is fixed in the latest version of
lm-sensors, which is due to be installed in the Debian FTP archive:

kernel-patch-2.4-lm-sensors_2.9.1-7_all.deb
  to pool/main/l/lm-sensors/kernel-patch-2.4-lm-sensors_2.9.1-7_all.deb
libsensors-dev_2.9.1-7_hppa.deb
  to pool/main/l/lm-sensors/libsensors-dev_2.9.1-7_hppa.deb
libsensors-dev_2.9.1-7_i386.deb
  to pool/main/l/lm-sensors/libsensors-dev_2.9.1-7_i386.deb
libsensors-dev_2.9.1-7_mips.deb
  to pool/main/l/lm-sensors/libsensors-dev_2.9.1-7_mips.deb
libsensors-dev_2.9.1-7_powerpc.deb
  to pool/main/l/lm-sensors/libsensors-dev_2.9.1-7_powerpc.deb
libsensors-dev_2.9.1-7_sparc.deb
  to pool/main/l/lm-sensors/libsensors-dev_2.9.1-7_sparc.deb
libsensors3_2.9.1-7_hppa.deb
  to pool/main/l/lm-sensors/libsensors3_2.9.1-7_hppa.deb
libsensors3_2.9.1-7_i386.deb
  to pool/main/l/lm-sensors/libsensors3_2.9.1-7_i386.deb
libsensors3_2.9.1-7_mips.deb
  to pool/main/l/lm-sensors/libsensors3_2.9.1-7_mips.deb
libsensors3_2.9.1-7_powerpc.deb
  to pool/main/l/lm-sensors/libsensors3_2.9.1-7_powerpc.deb
libsensors3_2.9.1-7_sparc.deb
  to pool/main/l/lm-sensors/libsensors3_2.9.1-7_sparc.deb
lm-sensors-2.4.27-2-386_2.9.1-7_i386.deb
  to pool/main/l/lm-sensors/lm-sensors-2.4.27-2-386_2.9.1-7_i386.deb
lm-sensors-2.4.27-2-586tsc_2.9.1-7_i386.deb
  to pool/main/l/lm-sensors/lm-sensors-2.4.27-2-586tsc_2.9.1-7_i386.deb
lm-sensors-2.4.27-2-686-smp_2.9.1-7_i386.deb
  to pool/main/l/lm-sensors/lm-sensors-2.4.27-2-686-smp_2.9.1-7_i386.deb
lm-sensors-2.4.27-2-686_2.9.1-7_i386.deb
  to pool/main/l/lm-sensors/lm-sensors-2.4.27-2-686_2.9.1-7_i386.deb
lm-sensors-2.4.27-2-k6_2.9.1-7_i386.deb
  to pool/main/l/lm-sensors/lm-sensors-2.4.27-2-k6_2.9.1-7_i386.deb
lm-sensors-2.4.27-2-k7-smp_2.9.1-7_i386.deb
  to pool/main/l/lm-sensors/lm-sensors-2.4.27-2-k7-smp_2.9.1-7_i386.deb
lm-sensors-2.4.27-2-k7_2.9.1-7_i386.deb
  to pool/main/l/lm-sensors/lm-sensors-2.4.27-2-k7_2.9.1-7_i386.deb
lm-sensors-source_2.9.1-7_all.deb
  to pool/main/l/lm-sensors/lm-sensors-source_2.9.1-7_all.deb
lm-sensors_2.9.1-7.diff.gz
  to pool/main/l/lm-sensors/lm-sensors_2.9.1-7.diff.gz
lm-sensors_2.9.1-7.dsc
  to pool/main/l/lm-sensors/lm-sensors_2.9.1-7.dsc
lm-sensors_2.9.1-7_hppa.deb
  to pool/main/l/lm-sensors/lm-sensors_2.9.1-7_hppa.deb
lm-sensors_2.9.1-7_i386.deb
  to pool/main/l/lm-sensors/lm-sensors_2.9.1-7_i386.deb
lm-sensors_2.9.1-7_mips.deb
  to pool/main/l/lm-sensors/lm-sensors_2.9.1-7_mips.deb
lm-sensors_2.9.1-7_powerpc.deb
  to pool/main/l/lm-sensors/lm-sensors_2.9.1-7_powerpc.deb
lm-sensors_2.9.1-7_sparc.deb
  to pool/main/l/lm-sensors/lm-sensors_2.9.1-7_sparc.deb
sensord_2.9.1-7_hppa.deb
  to pool/main/l/lm-sensors/sensord_2.9.1-7_hppa.deb
sensord_2.9.1-7_i386.deb
  to pool/main/l/lm-sensors/sensord_2.9.1-7_i386.deb
sensord_2.9.1-7_mips.deb
  to pool/main/l/lm-sensors/sensord_2.9.1-7_mips.deb
sensord_2.9.1-7_powerpc.deb
  to pool/main/l/lm-sensors/sensord_2.9.1-7_powerp...

Message-Id: <E1E6dWM-0005jr-00@spohr.debian.org>
Date: Sat, 20 Aug 2005 17:17:06 -0700
From: Aurelien Jarno <aurel32@debian.org>
To: 324193-close@bugs.debian.org
Subject: Bug#324193: fixed in lm-sensors 1:2.9.1-7

Source: lm-sensors
Source-Version: 1:2.9.1-7

We believe that the bug you reported is fixed in the latest version of
lm-sensors, which is due to be installed in the Debian FTP archive:

kernel-patch-2.4-lm-sensors_2.9.1-7_all.deb
  to pool/main/l/lm-sensors/kernel-patch-2.4-lm-sensors_2.9.1-7_all.deb
libsensors-dev_2.9.1-7_hppa.deb
  to pool/main/l/lm-sensors/libsensors-dev_2.9.1-7_hppa.deb
libsensors-dev_2.9.1-7_i386.deb
  to pool/main/l/lm-sensors/libsensors-dev_2.9.1-7_i386.deb
libsensors-dev_2.9.1-7_mips.deb
  to pool/main/l/lm-sensors/libsensors-dev_2.9.1-7_mips.deb
libsensors-dev_2.9.1-7_powerpc.deb
  to pool/main/l/lm-sensors/libsensors-dev_2.9.1-7_powerpc.deb
libsensors-dev_2.9.1-7_sparc.deb
  to pool/main/l/lm-sensors/libsensors-dev_2.9.1-7_sparc.deb
libsensors3_2.9.1-7_hppa.deb
  to pool/main/l/lm-sensors/libsensors3_2.9.1-7_hppa.deb
libsensors3_2.9.1-7_i386.deb
  to pool/main/l/lm-sensors/libsensors3_2.9.1-7_i386.deb
libsensors3_2.9.1-7_mips.deb
  to pool/main/l/lm-sensors/libsensors3_2.9.1-7_mips.deb
libsensors3_2.9.1-7_powerpc.deb
  to pool/main/l/lm-sensors/libsensors3_2.9.1-7_powerpc.deb
libsensors3_2.9.1-7_sparc.deb
  to pool/main/l/lm-sensors/libsensors3_2.9.1-7_sparc.deb
lm-sensors-2.4.27-2-386_2.9.1-7_i386.deb
  to pool/main/l/lm-sensors/lm-sensors-2.4.27-2-386_2.9.1-7_i386.deb
lm-sensors-2.4.27-2-586tsc_2.9.1-7_i386.deb
  to pool/main/l/lm-sensors/lm-sensors-2.4.27-2-586tsc_2.9.1-7_i386.deb
lm-sensors-2.4.27-2-686-smp_2.9.1-7_i386.deb
  to pool/main/l/lm-sensors/lm-sensors-2.4.27-2-686-smp_2.9.1-7_i386.deb
lm-sensors-2.4.27-2-686_2.9.1-7_i386.deb
  to pool/main/l/lm-sensors/lm-sensors-2.4.27-2-686_2.9.1-7_i386.deb
lm-sensors-2.4.27-2-k6_2.9.1-7_i386.deb
  to pool/main/l/lm-sensors/lm-sensors-2.4.27-2-k6_2.9.1-7_i386.deb
lm-sensors-2.4.27-2-k7-smp_2.9.1-7_i386.deb
  to pool/main/l/lm-sensors/lm-sensors-2.4.27-2-k7-smp_2.9.1-7_i386.deb
lm-sensors-2.4.27-2-k7_2.9.1-7_i386.deb
  to pool/main/l/lm-sensors/lm-sensors-2.4.27-2-k7_2.9.1-7_i386.deb
lm-sensors-source_2.9.1-7_all.deb
  to pool/main/l/lm-sensors/lm-sensors-source_2.9.1-7_all.deb
lm-sensors_2.9.1-7.diff.gz
  to pool/main/l/lm-sensors/lm-sensors_2.9.1-7.diff.gz
lm-sensors_2.9.1-7.dsc
  to pool/main/l/lm-sensors/lm-sensors_2.9.1-7.dsc
lm-sensors_2.9.1-7_hppa.deb
  to pool/main/l/lm-sensors/lm-sensors_2.9.1-7_hppa.deb
lm-sensors_2.9.1-7_i386.deb
  to pool/main/l/lm-sensors/lm-sensors_2.9.1-7_i386.deb
lm-sensors_2.9.1-7_mips.deb
  to pool/main/l/lm-sensors/lm-sensors_2.9.1-7_mips.deb
lm-sensors_2.9.1-7_powerpc.deb
  to pool/main/l/lm-sensors/lm-sensors_2.9.1-7_powerpc.deb
lm-sensors_2.9.1-7_sparc.deb
  to pool/main/l/lm-sensors/lm-sensors_2.9.1-7_sparc.deb
sensord_2.9.1-7_hppa.deb
  to pool/main/l/lm-sensors/sensord_2.9.1-7_hppa.deb
sensord_2.9.1-7_i386.deb
  to pool/main/l/lm-sensors/sensord_2.9.1-7_i386.deb
sensord_2.9.1-7_mips.deb
  to pool/main/l/lm-sensors/sensord_2.9.1-7_mips.deb
sensord_2.9.1-7_powerpc.deb
  to pool/main/l/lm-sensors/sensord_2.9.1-7_powerpc.deb
sensord_2.9.1-7_sparc.deb
  to pool/main/l/lm-sensors/sensord_2.9.1-7_sparc.deb

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 324193@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Aurelien Jarno <aurel32@debian.org> (supplier of updated lm-sensors package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.7
Date: Sat, 20 Aug 2005 22:12:54 +0200
Source: lm-sensors
Binary: lm-sensors-2.4.27-2-386 lm-sensors-source lm-sensors-2.4.27-2-k7 libsensors-dev lm-sensors-2.4.27-2-k7-smp lm-sensors-2.4.27-2-586tsc lm-sensors sensord kernel-patch-2.4-lm-sensors lm-sensors-2.4.27-2-686 lm-sensors-2.4.27-2-k6 lm-sensors-2.4.27-2-686-smp libsensors3
Architecture: all hppa i386 mips powerpc source sparc 
Version: 1:2.9.1-7
Distribution: unstable
Urgency: high
Maintainer: Aurelien Jarno <aurel32@debian.org>
Changed-By: Aurelien Jarno <aurel32@debian.org>
Description: 
 libsensors-dev - lm-sensors development kit
 libsensors3 - library to read temperature/voltage/fan sensors
 lm-sensors - utilities to read temperature/voltage/fan sensors
 sensord    - hardware sensor information logging daemon
Closes: 324193
Changes: 
 lm-sensors (1:2.9.1-7) unstable; urgency=high
 .
   * Urgency set to high due to security fix.
   * Fixed and insecure tempfile usage in pwmconfig. Thanks to Javier
     Fernández-Sanguino Peña <jfs@computer.org> for the bug report and the
     patch (closes: bug#324193).
Files: 
 0516aaf8e29df8c9649895b4172823ef 258084 utils extra lm-sensors-2.4.27-2-386_2.9.1-7_i386.deb
 0585b3d2ac5e5606097833356767f1f7 941732 misc extra lm-sensors-source_2.9.1-7_all.deb
 0aa708156bb116d038268c1968e54f00 1086 utils extra lm-sensors_2.9.1-7.dsc
 1787514e5eb011bc4c20274fc963b5d5 107066 libdevel extra libsensors-dev_2.9.1-7_powerpc.deb
 1e62f1a2097bee1ebf426d8f381af6fa 258026 utils extra lm-sensors-2.4.27-2-586tsc_2.9.1-7_i386.deb
 210ffba71baecdf9813d250a4548a2b1 474082 utils extra lm-sensors_2.9.1-7_hppa.deb
 36c2b2092c0a7aeb6993b3e4cb9bebff 100668 libdevel extra libsensors-dev_2.9.1-7_sparc.deb
 493108678d39c69d36345a4825cfcd39 304740 devel extra kernel-patch-2.4-lm-sensors_2.9.1-7_all.deb
 4fac1b4f1e79e9c4ccfa65f5478d67bd 33521 utils extra lm-sensors_2.9.1-7.diff.gz
 6aa7e28a0349ae4c107c84aa08e11ffa 258104 utils extra lm-sensors-2.4.27-2-k6_2.9.1-7_i386.deb
 72fe5179b837f867deb3c8bf2f86155c 469182 utils extra lm-sensors_2.9.1-7_i386.deb
 748e4a1ada4ab6a3919d1b5eff45b9dd 471554 utils extra lm-sensors_2.9.1-7_powerpc.deb
 798123a11b44866e257a2fcad8b898ca 258518 utils extra lm-sensors-2.4.27-2-686-smp_2.9.1-7_i386.deb
 7a4b6e65ab67b821ca5126f4224cb4a2 59448 utils extra sensord_2.9.1-7_hppa.deb
 840e4b15760ea78e1504a674c9eae9fd 258856 utils extra lm-sensors-2.4.27-2-k7-smp_2.9.1-7_i386.deb
 9164834eca8b10bb84f5c63904fa4394 469068 utils extra lm-sensors_2.9.1-7_mips.deb
 9c5bed74ce03f94e5ce7ae1908e15386 93186 libdevel extra libsensors-dev_2.9.1-7_i386.deb
 a19218e71ef3fe21df879496fe84f29a 82132 libs optional libsensors3_2.9.1-7_mips.deb
 ae355a7965b87190c50e7288bfce1398 77504 libs optional libsensors3_2.9.1-7_i386.deb
 b46c41f23141c6f79a62977cce90fd60 467912 utils extra lm-sensors_2.9.1-7_sparc.deb
 c678a0c2e5a21b8e245b0c9b0e91d2bc 59266 utils extra sensord_2.9.1-7_mips.deb
 cab3debe919916b807439a65294d4173 258368 utils extra lm-sensors-2.4.27-2-k7_2.9.1-7_i386.deb
 d04b1103cb3fb687cf1a5a962c3754e9 56180 utils extra sensord_2.9.1-7_i386.deb
 da4616930c9a272b87d4660bb955c6c5 56872 utils extra sensord_2.9.1-7_sparc.deb
 dbc952fa5d0e1a3320afa93e593f2a39 85302 libs optional libsensors3_2.9.1-7_powerpc.deb
 dd2adf9e678fdab7e7f1dbaca3173b44 81968 libs optional libsensors3_2.9.1-7_sparc.deb
 e260695ab74bd63805dc016441fed720 103650 libdevel extra libsensors-dev_2.9.1-7_mips.deb
 e38912090e5083e8f2f320d9b66f1275 104894 libdevel extra libsensors-dev_2.9.1-7_hppa.deb
 ec9414cc5fe31750d1ac6eb77bcf04a8 258078 utils extra lm-sensors-2.4.27-2-686_2.9.1-7_i386.deb
 f4fdf9a4e6730892154e7dadcf668703 89014 libs optional libsensors3_2.9.1-7_hppa.deb
 fe6f24f759921708b42d03e987a716d2 59310 utils extra sensord_2.9.1-7_powerpc.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQFDB8Yww3ao2vG823MRAo0XAJ90DZfFg6t7eyXJcZ/MCdrO/OIUlwCfbkPS
mwy8X0LTERAkDvBFava7a3E=
=lk2F
-----END PGP SIGNATURE-----

Revision history for this message

Debian Bug Importer (debzilla) wrote on 2005-09-22:

#14

Message-ID: <email address hidden>
Date: Sun, 21 Aug 2005 12:17:59 +0200
From: Aurelien Jarno <email address hidden>
To: <email address hidden>
Subject: Reopening the bug for sarge and etch

reopen 324193
tag 324193 + sarge
tag 324193 + etch
thanks

--
.''`. Aurelien Jarno | GPG: 1024D/F1BCDB73
: :' : Debian GNU/Linux developer | Electrical Engineer
`. `' <email address hidden> | <email address hidden>
`- people.debian.org/~aurel32 | www.aurel32.net

Revision history for this message

Debian Bug Importer (debzilla) wrote on 2005-09-22:

#15

Message-ID: <email address hidden>
Date: Wed, 24 Aug 2005 08:47:53 +0200
From: Martin Pitt <email address hidden>
To: <email address hidden>
Subject: Fwd: CAN-2005-2672 assigned to pwmconfig symlink

--wac7ysb48OaltWcw
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Hi!

This got a CAN number assigned. Can you please mention it in the
changelog when you fix this?

Thanks,

Martin

----- Forwarded message from "Steven M. Christey" <email address hidden> -----

Date: Tue, 23 Aug 2005 14:53:06 -0400 (EDT)
=46rom: "Steven M. Christey" <email address hidden>
To: <email address hidden>, <email address hidden>
Cc: <email address hidden>
Subject: CAN-2005-2672 assigned to pwmconfig symlink
X-Spam-Status: No, score=3D1.4 required=3D4.0 tests=3DAWL,BAYES_50 autolear=
n=3Dno=20
version=3D3.0.3

FYI...

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D
Candidate: CAN-2005-2672
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCAN-2005-2672
Reference: BID:14624
Reference: URL:http://www.securityfocus.com/bid/14624
Reference: UBUNTU:USN-172-1
Reference: URL:http://www.ubuntulinux.org/support/documentation/usn/usn-172=
-1
Reference: CONFIRM:http://secure.netroedge.com/~lm78/cvs/lm_sensors2/CHANGES

pwmconfig in LM_sensors before 2.9.1 creates temporary files
insecurely, which allows local users to overwrite arbitrary files via
a symlink attack on the fancontrol temporary file.

----- End forwarded message -----

--=20
Martin Pitt http://www.piware.de
Ubuntu Developer http://www.ubuntu.com
Debian Developer http://www.debian.org

--wac7ysb48OaltWcw
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQFDDBgYDecnbV4Fd/IRAlSPAJ4vG//KqksiBTIV+j2GVXTTjAwK8QCg7KIC
dEkdcQvYwek3Vn8vmnqInsY=
=U8DS
-----END PGP SIGNATURE-----

--wac7ysb48OaltWcw--

Message-ID: <20050824064752.GA17899@piware.de>
Date: Wed, 24 Aug 2005 08:47:53 +0200
From: Martin Pitt <mpitt@debian.org>
To: 324193@bugs.debian.org
Subject: Fwd: CAN-2005-2672 assigned to pwmconfig symlink

--wac7ysb48OaltWcw
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Hi!

This got a CAN number assigned. Can you please mention it in the
changelog when you fix this?

Thanks,

Martin

----- Forwarded message from "Steven M. Christey" <coley@mitre.org> -----

Date: Tue, 23 Aug 2005 14:53:06 -0400 (EDT)
=46rom: "Steven M. Christey" <coley@mitre.org>
To: joey@infodrom.org, martin.pitt@canonical.com
Cc: coley@mitre.org
Subject: CAN-2005-2672 assigned to pwmconfig symlink
X-Spam-Status: No, score=3D1.4 required=3D4.0 tests=3DAWL,BAYES_50 autolear=
n=3Dno=20
	version=3D3.0.3

FYI...

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D
Candidate: CAN-2005-2672
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCAN-2005-2672
Reference: BID:14624
Reference: URL:http://www.securityfocus.com/bid/14624
Reference: UBUNTU:USN-172-1
Reference: URL:http://www.ubuntulinux.org/support/documentation/usn/usn-172=
-1
Reference: CONFIRM:http://secure.netroedge.com/~lm78/cvs/lm_sensors2/CHANGES

pwmconfig in LM_sensors before 2.9.1 creates temporary files
insecurely, which allows local users to overwrite arbitrary files via
a symlink attack on the fancontrol temporary file.

----- End forwarded message -----

--=20
Martin Pitt        http://www.piware.de
Ubuntu Developer   http://www.ubuntu.com
Debian Developer   http://www.debian.org

--wac7ysb48OaltWcw
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQFDDBgYDecnbV4Fd/IRAlSPAJ4vG//KqksiBTIV+j2GVXTTjAwK8QCg7KIC
dEkdcQvYwek3Vn8vmnqInsY=
=U8DS
-----END PGP SIGNATURE-----

--wac7ysb48OaltWcw--

Revision history for this message

Debian Bug Importer (debzilla) wrote on 2005-09-22:

#16

Message-ID: <email address hidden>
Date: Wed, 24 Aug 2005 11:10:53 +0200
From: Aurelien Jarno <email address hidden>
To: Martin Pitt <email address hidden>, <email address hidden>
Subject: Re: Bug#324193: Fwd: CAN-2005-2672 assigned to pwmconfig symlink

On Wed, Aug 24, 2005 at 08:47:53AM +0200, Martin Pitt wrote:
> Hi!
>
> This got a CAN number assigned. Can you please mention it in the
> changelog when you fix this?

Well, the bug is now fixed for a few days. I have decided to fix it
without a CAN number because I was unable to get one (got no answer from
the security team, and it is still the case).

Should I upload a new version, just adding this CAN number.

Bye,
Aurelien

--
.''`. Aurelien Jarno | GPG: 1024D/F1BCDB73
: :' : Debian GNU/Linux developer | Electrical Engineer
`. `' <email address hidden> | <email address hidden>
`- people.debian.org/~aurel32 | www.aurel32.net

Revision history for this message

Debian Bug Importer (debzilla) wrote on 2005-09-22:

#17

Message-ID: <email address hidden>
Date: Wed, 24 Aug 2005 13:47:00 +0200
From: Martin Pitt <email address hidden>
To: Aurelien Jarno <email address hidden>, <email address hidden>
Subject: Re: Bug#324193: Fwd: CAN-2005-2672 assigned to pwmconfig symlink

Hi Aurelien!

Aurelien Jarno [2005-08-24 11:10 +0200]:
> On Wed, Aug 24, 2005 at 08:47:53AM +0200, Martin Pitt wrote:
> > Hi!
> >
> > This got a CAN number assigned. Can you please mention it in the
> > changelog when you fix this?
>
> Well, the bug is now fixed for a few days. I have decided to fix it
> without a CAN number because I was unable to get one (got no answer from
> the security team, and it is still the case).

Ah, fine.

> Should I upload a new version, just adding this CAN number.

No, that's not worth the trouble. However, it would be nice if you
could add it at the next regular upload.

Thanks!

Martin
--
Martin Pitt http://www.piware.de
Ubuntu Developer http://www.ubuntu.com
Debian Developer http://www.debian.org

Revision history for this message

Debian Bug Importer (debzilla) wrote on 2005-09-22:

#18

Message-Id: <email address hidden>
Date: Thu, 15 Sep 2005 07:17:12 -0700
From: Martin Schulze <email address hidden>
To: <email address hidden>
Cc: Martin Schulze <email address hidden>, Martin Schulze <email address hidden>
Subject: Fixed in NMU of lm-sensors 1:2.9.1-1sarge2

tag 324193 + fixed

quit

This message was generated automatically in response to a
non-maintainer upload. The .changes file follows.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.7
Date: Mon, 12 Sep 2005 09:13:40 +0200
Source: lm-sensors
Binary: lm-sensors-2.4.27-2-386 lm-sensors-source lm-sensors-2.4.27-2-k7 libsensors-dev lm-sensors-2.4.27-2-k7-smp lm-sensors-2.4.27-2-586tsc lm-sensors sensord kernel-patch-2.4-lm-sensors lm-sensors-2.4.27-2-686 lm-sensors-2.4.27-2-k6 lm-sensors-2.4.27-2-686-smp libsensors3
Architecture: source powerpc all
Version: 1:2.9.1-1sarge2
Distribution: stable-security
Urgency: high
Maintainer: Martin Schulze <email address hidden>
Changed-By: Martin Schulze <email address hidden>
Description:
kernel-patch-2.4-lm-sensors - drivers to read temperature/voltage/fan sensors
libsensors-dev - lm-sensors development kit
libsensors3 - library to read temperature/voltage/fan sensors
lm-sensors - utilities to read temperature/voltage/fan sensors
lm-sensors-source - kernel drivers to read temperature/voltage/fan sensors (source)
sensord - hardware sensor information logging daemon
Closes: 324193
Changes:
lm-sensors (1:2.9.1-1sarge2) stable-security; urgency=high
.
   * Non-maintainer upload by the Security Team
   * Applied maintainer patch to fix insecure temporary file creation
     [prog/pwm/pwmconfig, CAN-2005-2672], Closes: Bug#324193
Files:
b29b66e67c0cdc230e00e5183724427a 1089 utils extra lm-sensors_2.9.1-1sarge2.dsc
551c338fbc31a17f7fd909c8c18f495e 32896 utils extra lm-sensors_2.9.1-1sarge2.diff.gz
326fe3274869079637c4a425430d9cc9 476730 utils extra lm-sensors_2.9.1-1sarge2_powerpc.deb
362b899e12a413c46a1aa3bb80ae9564 84122 libs optional libsensors3_2.9.1-1sarge2_powerpc.deb
1c01fa48983ca51785fb6cebcb1352e7 105926 libdevel extra libsensors-dev_2.9.1-1sarge2_powerpc.deb
2be27fc39b66107b8bc28df51bfd929f 59362 utils extra sensord_2.9.1-1sarge2_powerpc.deb
9b936604bcb60dd90c26de965bc8ae7f 304604 devel extra kernel-patch-2.4-lm-sensors_2.9.1-1sarge2_all.deb
a4cc7cf62245912cca061249e7ff153e 956166 misc extra lm-sensors-source_2.9.1-1sarge2_all.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQFDJTECW5ql+IAeqTIRAuYEAKCD8P/umMhut8akP+7w4TF+B64QwACfW9p8
uH1Yn+P/8dLaOiF2Utez5nk=
=Q2Di
-----END PGP SIGNATURE-----

Message-Id: <E1EFuY4-0001rZ-00@spohr.debian.org>
Date: Thu, 15 Sep 2005 07:17:12 -0700
From: Martin Schulze <joey@infodrom.org>
To: control@bugs.debian.org
Cc: Martin Schulze <joey@infodrom.org>, Martin Schulze <joey@debian.org>
Subject: Fixed in NMU of lm-sensors 1:2.9.1-1sarge2

tag 324193 + fixed

quit

This message was generated automatically in response to a
non-maintainer upload.  The .changes file follows.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.7
Date: Mon, 12 Sep 2005 09:13:40 +0200
Source: lm-sensors
Binary: lm-sensors-2.4.27-2-386 lm-sensors-source lm-sensors-2.4.27-2-k7 libsensors-dev lm-sensors-2.4.27-2-k7-smp lm-sensors-2.4.27-2-586tsc lm-sensors sensord kernel-patch-2.4-lm-sensors lm-sensors-2.4.27-2-686 lm-sensors-2.4.27-2-k6 lm-sensors-2.4.27-2-686-smp libsensors3
Architecture: source powerpc all
Version: 1:2.9.1-1sarge2
Distribution: stable-security
Urgency: high
Maintainer: Martin Schulze <joey@debian.org>
Changed-By: Martin Schulze <joey@infodrom.org>
Description: 
 kernel-patch-2.4-lm-sensors - drivers to read temperature/voltage/fan sensors
 libsensors-dev - lm-sensors development kit
 libsensors3 - library to read temperature/voltage/fan sensors
 lm-sensors - utilities to read temperature/voltage/fan sensors
 lm-sensors-source - kernel drivers to read temperature/voltage/fan sensors (source)
 sensord    - hardware sensor information logging daemon
Closes: 324193
Changes: 
 lm-sensors (1:2.9.1-1sarge2) stable-security; urgency=high
 .
   * Non-maintainer upload by the Security Team
   * Applied maintainer patch to fix insecure temporary file creation
     [prog/pwm/pwmconfig, CAN-2005-2672], Closes: Bug#324193
Files: 
 b29b66e67c0cdc230e00e5183724427a 1089 utils extra lm-sensors_2.9.1-1sarge2.dsc
 551c338fbc31a17f7fd909c8c18f495e 32896 utils extra lm-sensors_2.9.1-1sarge2.diff.gz
 326fe3274869079637c4a425430d9cc9 476730 utils extra lm-sensors_2.9.1-1sarge2_powerpc.deb
 362b899e12a413c46a1aa3bb80ae9564 84122 libs optional libsensors3_2.9.1-1sarge2_powerpc.deb
 1c01fa48983ca51785fb6cebcb1352e7 105926 libdevel extra libsensors-dev_2.9.1-1sarge2_powerpc.deb
 2be27fc39b66107b8bc28df51bfd929f 59362 utils extra sensord_2.9.1-1sarge2_powerpc.deb
 9b936604bcb60dd90c26de965bc8ae7f 304604 devel extra kernel-patch-2.4-lm-sensors_2.9.1-1sarge2_all.deb
 a4cc7cf62245912cca061249e7ff153e 956166 misc extra lm-sensors-source_2.9.1-1sarge2_all.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQFDJTECW5ql+IAeqTIRAuYEAKCD8P/umMhut8akP+7w4TF+B64QwACfW9p8
uH1Yn+P/8dLaOiF2Utez5nk=
=Q2Di
-----END PGP SIGNATURE-----

Revision history for this message

Debian Bug Importer (debzilla) wrote on 2005-09-22:

#19

Message-ID: <email address hidden>
Date: Thu, 15 Sep 2005 19:33:48 +0200
From: Aurelien Jarno <email address hidden>
To: <email address hidden>
Subject: bug only present in etch

tag 324193 - sarge
tag 324193 - fixed
thanks

--
.''`. Aurelien Jarno | GPG: 1024D/F1BCDB73
: :' : Debian GNU/Linux developer | Electrical Engineer
`. `' <email address hidden> | <email address hidden>
`- people.debian.org/~aurel32 | www.aurel32.net

Revision history for this message

In Debian Bug tracker #324193, Aurelien Jarno (aurelien-aurel32) wrote on 2005-10-20: Closing the bug

#20

lm-sensors has been moved to etch. Closing the bug.

--
.''`. Aurelien Jarno | GPG: 1024D/F1BCDB73
: :' : Debian developer | Electrical Engineer
`. `' <email address hidden> | <email address hidden>
`- people.debian.org/~aurel32 | www.aurel32.net

Revision history for this message

In Debian Bug tracker #324193, Steve Langasek (vorlon) wrote on 2005-10-20: version tracking, please

#21

reopen 324193
found 324193 1:2.9.1-1
close 324193 1:2.9.1-7
close 324193 1:2.9.1-1sarge2
thanks

Revision history for this message

Debian Bug Importer (debzilla) wrote on 2005-10-21:

#22

Message-ID: <email address hidden>
Date: Fri, 21 Oct 2005 01:19:57 +0200
From: Aurelien Jarno <email address hidden>
To: <email address hidden>
Subject: Closing the bug

lm-sensors has been moved to etch. Closing the bug.

--
.''`. Aurelien Jarno | GPG: 1024D/F1BCDB73
: :' : Debian developer | Electrical Engineer
`. `' <email address hidden> | <email address hidden>
`- people.debian.org/~aurel32 | www.aurel32.net

Revision history for this message

Debian Bug Importer (debzilla) wrote on 2005-10-21:

#23

Message-ID: <email address hidden>
Date: Thu, 20 Oct 2005 16:51:44 -0700
From: Steve Langasek <email address hidden>
To: <email address hidden>
Subject: version tracking, please

reopen 324193
found 324193 1:2.9.1-1
close 324193 1:2.9.1-7
close 324193 1:2.9.1-1sarge2
thanks

Revision history for this message

In Debian Bug tracker #324193, Martin Schulze (joey-infodrom) wrote on 2005-12-17: Fixed in NMU of lm-sensors 1:2.9.1-1sarge2

#24

tag 324193 + fixed

quit

This message was generated automatically in response to a
non-maintainer upload. The .changes file follows.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.7
Date: Mon, 12 Sep 2005 09:13:40 +0200
Source: lm-sensors
Binary: lm-sensors-2.4.27-2-386 lm-sensors-source lm-sensors-2.4.27-2-k7 libsensors-dev lm-sensors-2.4.27-2-k7-smp lm-sensors-2.4.27-2-586tsc lm-sensors sensord kernel-patch-2.4-lm-sensors lm-sensors-2.4.27-2-686 lm-sensors-2.4.27-2-k6 lm-sensors-2.4.27-2-686-smp libsensors3
Architecture: source powerpc all
Version: 1:2.9.1-1sarge2
Distribution: stable-security
Urgency: high
Maintainer: Martin Schulze <email address hidden>
Changed-By: Martin Schulze <email address hidden>
Description:
kernel-patch-2.4-lm-sensors - drivers to read temperature/voltage/fan sensors
libsensors-dev - lm-sensors development kit
libsensors3 - library to read temperature/voltage/fan sensors
lm-sensors - utilities to read temperature/voltage/fan sensors
lm-sensors-source - kernel drivers to read temperature/voltage/fan sensors (source)
sensord - hardware sensor information logging daemon
Closes: 324193
Changes:
lm-sensors (1:2.9.1-1sarge2) stable-security; urgency=high
.
   * Non-maintainer upload by the Security Team
   * Applied maintainer patch to fix insecure temporary file creation
     [prog/pwm/pwmconfig, CAN-2005-2672], Closes: Bug#324193
Files:
b29b66e67c0cdc230e00e5183724427a 1089 utils extra lm-sensors_2.9.1-1sarge2.dsc
551c338fbc31a17f7fd909c8c18f495e 32896 utils extra lm-sensors_2.9.1-1sarge2.diff.gz
326fe3274869079637c4a425430d9cc9 476730 utils extra lm-sensors_2.9.1-1sarge2_powerpc.deb
362b899e12a413c46a1aa3bb80ae9564 84122 libs optional libsensors3_2.9.1-1sarge2_powerpc.deb
1c01fa48983ca51785fb6cebcb1352e7 105926 libdevel extra libsensors-dev_2.9.1-1sarge2_powerpc.deb
2be27fc39b66107b8bc28df51bfd929f 59362 utils extra sensord_2.9.1-1sarge2_powerpc.deb
9b936604bcb60dd90c26de965bc8ae7f 304604 devel extra kernel-patch-2.4-lm-sensors_2.9.1-1sarge2_all.deb
a4cc7cf62245912cca061249e7ff153e 956166 misc extra lm-sensors-source_2.9.1-1sarge2_all.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQFDJTECW5ql+IAeqTIRAuYEAKCD8P/umMhut8akP+7w4TF+B64QwACfW9p8
uH1Yn+P/8dLaOiF2Utez5nk=
=Q2Di
-----END PGP SIGNATURE-----

tag 324193 + fixed

quit

This message was generated automatically in response to a
non-maintainer upload.  The .changes file follows.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.7
Date: Mon, 12 Sep 2005 09:13:40 +0200
Source: lm-sensors
Binary: lm-sensors-2.4.27-2-386 lm-sensors-source lm-sensors-2.4.27-2-k7 libsensors-dev lm-sensors-2.4.27-2-k7-smp lm-sensors-2.4.27-2-586tsc lm-sensors sensord kernel-patch-2.4-lm-sensors lm-sensors-2.4.27-2-686 lm-sensors-2.4.27-2-k6 lm-sensors-2.4.27-2-686-smp libsensors3
Architecture: source powerpc all
Version: 1:2.9.1-1sarge2
Distribution: stable-security
Urgency: high
Maintainer: Martin Schulze <joey@debian.org>
Changed-By: Martin Schulze <joey@infodrom.org>
Description: 
 kernel-patch-2.4-lm-sensors - drivers to read temperature/voltage/fan sensors
 libsensors-dev - lm-sensors development kit
 libsensors3 - library to read temperature/voltage/fan sensors
 lm-sensors - utilities to read temperature/voltage/fan sensors
 lm-sensors-source - kernel drivers to read temperature/voltage/fan sensors (source)
 sensord    - hardware sensor information logging daemon
Closes: 324193
Changes: 
 lm-sensors (1:2.9.1-1sarge2) stable-security; urgency=high
 .
   * Non-maintainer upload by the Security Team
   * Applied maintainer patch to fix insecure temporary file creation
     [prog/pwm/pwmconfig, CAN-2005-2672], Closes: Bug#324193
Files: 
 b29b66e67c0cdc230e00e5183724427a 1089 utils extra lm-sensors_2.9.1-1sarge2.dsc
 551c338fbc31a17f7fd909c8c18f495e 32896 utils extra lm-sensors_2.9.1-1sarge2.diff.gz
 326fe3274869079637c4a425430d9cc9 476730 utils extra lm-sensors_2.9.1-1sarge2_powerpc.deb
 362b899e12a413c46a1aa3bb80ae9564 84122 libs optional libsensors3_2.9.1-1sarge2_powerpc.deb
 1c01fa48983ca51785fb6cebcb1352e7 105926 libdevel extra libsensors-dev_2.9.1-1sarge2_powerpc.deb
 2be27fc39b66107b8bc28df51bfd929f 59362 utils extra sensord_2.9.1-1sarge2_powerpc.deb
 9b936604bcb60dd90c26de965bc8ae7f 304604 devel extra kernel-patch-2.4-lm-sensors_2.9.1-1sarge2_all.deb
 a4cc7cf62245912cca061249e7ff153e 956166 misc extra lm-sensors-source_2.9.1-1sarge2_all.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQFDJTECW5ql+IAeqTIRAuYEAKCD8P/umMhut8akP+7w4TF+B64QwACfW9p8
uH1Yn+P/8dLaOiF2Utez5nk=
=Q2Di
-----END PGP SIGNATURE-----

Revision history for this message

Debian Bug Importer (debzilla) wrote on 2005-12-17:

#25

Message-Id: <email address hidden>
Date: Fri, 16 Dec 2005 21:33:03 -0800
From: Martin Schulze <email address hidden>
To: <email address hidden>
Cc: Martin Schulze <email address hidden>, Martin Schulze <email address hidden>
Subject: Fixed in NMU of lm-sensors 1:2.9.1-1sarge2

tag 324193 + fixed

quit

This message was generated automatically in response to a
non-maintainer upload. The .changes file follows.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.7
Date: Mon, 12 Sep 2005 09:13:40 +0200
Source: lm-sensors
Binary: lm-sensors-2.4.27-2-386 lm-sensors-source lm-sensors-2.4.27-2-k7 libsensors-dev lm-sensors-2.4.27-2-k7-smp lm-sensors-2.4.27-2-586tsc lm-sensors sensord kernel-patch-2.4-lm-sensors lm-sensors-2.4.27-2-686 lm-sensors-2.4.27-2-k6 lm-sensors-2.4.27-2-686-smp libsensors3
Architecture: source powerpc all
Version: 1:2.9.1-1sarge2
Distribution: stable-security
Urgency: high
Maintainer: Martin Schulze <email address hidden>
Changed-By: Martin Schulze <email address hidden>
Description:
kernel-patch-2.4-lm-sensors - drivers to read temperature/voltage/fan sensors
libsensors-dev - lm-sensors development kit
libsensors3 - library to read temperature/voltage/fan sensors
lm-sensors - utilities to read temperature/voltage/fan sensors
lm-sensors-source - kernel drivers to read temperature/voltage/fan sensors (source)
sensord - hardware sensor information logging daemon
Closes: 324193
Changes:
lm-sensors (1:2.9.1-1sarge2) stable-security; urgency=high
.
   * Non-maintainer upload by the Security Team
   * Applied maintainer patch to fix insecure temporary file creation
     [prog/pwm/pwmconfig, CAN-2005-2672], Closes: Bug#324193
Files:
b29b66e67c0cdc230e00e5183724427a 1089 utils extra lm-sensors_2.9.1-1sarge2.dsc
551c338fbc31a17f7fd909c8c18f495e 32896 utils extra lm-sensors_2.9.1-1sarge2.diff.gz
326fe3274869079637c4a425430d9cc9 476730 utils extra lm-sensors_2.9.1-1sarge2_powerpc.deb
362b899e12a413c46a1aa3bb80ae9564 84122 libs optional libsensors3_2.9.1-1sarge2_powerpc.deb
1c01fa48983ca51785fb6cebcb1352e7 105926 libdevel extra libsensors-dev_2.9.1-1sarge2_powerpc.deb
2be27fc39b66107b8bc28df51bfd929f 59362 utils extra sensord_2.9.1-1sarge2_powerpc.deb
9b936604bcb60dd90c26de965bc8ae7f 304604 devel extra kernel-patch-2.4-lm-sensors_2.9.1-1sarge2_all.deb
a4cc7cf62245912cca061249e7ff153e 956166 misc extra lm-sensors-source_2.9.1-1sarge2_all.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQFDJTECW5ql+IAeqTIRAuYEAKCD8P/umMhut8akP+7w4TF+B64QwACfW9p8
uH1Yn+P/8dLaOiF2Utez5nk=
=Q2Di
-----END PGP SIGNATURE-----

Message-Id: <E1EnUgp-0000QD-1a@spohr.debian.org>
Date: Fri, 16 Dec 2005 21:33:03 -0800
From: Martin Schulze <joey@infodrom.org>
To: control@bugs.debian.org
Cc: Martin Schulze <joey@infodrom.org>, Martin Schulze <joey@debian.org>
Subject: Fixed in NMU of lm-sensors 1:2.9.1-1sarge2

tag 324193 + fixed

quit

This message was generated automatically in response to a
non-maintainer upload.  The .changes file follows.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.7
Date: Mon, 12 Sep 2005 09:13:40 +0200
Source: lm-sensors
Binary: lm-sensors-2.4.27-2-386 lm-sensors-source lm-sensors-2.4.27-2-k7 libsensors-dev lm-sensors-2.4.27-2-k7-smp lm-sensors-2.4.27-2-586tsc lm-sensors sensord kernel-patch-2.4-lm-sensors lm-sensors-2.4.27-2-686 lm-sensors-2.4.27-2-k6 lm-sensors-2.4.27-2-686-smp libsensors3
Architecture: source powerpc all
Version: 1:2.9.1-1sarge2
Distribution: stable-security
Urgency: high
Maintainer: Martin Schulze <joey@debian.org>
Changed-By: Martin Schulze <joey@infodrom.org>
Description: 
 kernel-patch-2.4-lm-sensors - drivers to read temperature/voltage/fan sensors
 libsensors-dev - lm-sensors development kit
 libsensors3 - library to read temperature/voltage/fan sensors
 lm-sensors - utilities to read temperature/voltage/fan sensors
 lm-sensors-source - kernel drivers to read temperature/voltage/fan sensors (source)
 sensord    - hardware sensor information logging daemon
Closes: 324193
Changes: 
 lm-sensors (1:2.9.1-1sarge2) stable-security; urgency=high
 .
   * Non-maintainer upload by the Security Team
   * Applied maintainer patch to fix insecure temporary file creation
     [prog/pwm/pwmconfig, CAN-2005-2672], Closes: Bug#324193
Files: 
 b29b66e67c0cdc230e00e5183724427a 1089 utils extra lm-sensors_2.9.1-1sarge2.dsc
 551c338fbc31a17f7fd909c8c18f495e 32896 utils extra lm-sensors_2.9.1-1sarge2.diff.gz
 326fe3274869079637c4a425430d9cc9 476730 utils extra lm-sensors_2.9.1-1sarge2_powerpc.deb
 362b899e12a413c46a1aa3bb80ae9564 84122 libs optional libsensors3_2.9.1-1sarge2_powerpc.deb
 1c01fa48983ca51785fb6cebcb1352e7 105926 libdevel extra libsensors-dev_2.9.1-1sarge2_powerpc.deb
 2be27fc39b66107b8bc28df51bfd929f 59362 utils extra sensord_2.9.1-1sarge2_powerpc.deb
 9b936604bcb60dd90c26de965bc8ae7f 304604 devel extra kernel-patch-2.4-lm-sensors_2.9.1-1sarge2_all.deb
 a4cc7cf62245912cca061249e7ff153e 956166 misc extra lm-sensors-source_2.9.1-1sarge2_all.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQFDJTECW5ql+IAeqTIRAuYEAKCD8P/umMhut8akP+7w4TF+B64QwACfW9p8
uH1Yn+P/8dLaOiF2Utez5nk=
=Q2Di
-----END PGP SIGNATURE-----

Affects		Status	Importance	Assigned to	Milestone
	lm-sensors (Debian)	Fix Released	Unknown	debbugs #324193
	lm-sensors (Ubuntu)	Fix Released	High	Martin Pitt

Ubuntu
lm-sensors package

lm-sensors: Insecure tempfile usage in pwmconfig

Bug Description

CVE References

Other bug subscribers

Remote bug watches

Ubuntulm-sensors package

lm-sensors: Insecure tempfile usage in pwmconfig

Bug Description

CVE References

Other bug subscribers

Remote bug watches

Ubuntu
lm-sensors package