"-G" option destroys data

[Mark Suter]

Binary package hint: obexftp

I expected the "-G" option to be safe, that is, if for some reason the file
was not successfully transfered, it would not proceed with the deletion.

The following command destroyed data when my present working directory
was not writable. Even worse, there were no error messages of any kind, just
a file I no longer have.

    obexftp -c C: -c Data -G important.txt

$ cat /etc/lsb-release
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=7.10
DISTRIB_CODENAME=gutsy
DISTRIB_DESCRIPTION="Ubuntu 7.10"

$ dpkg -l obexftp | tail -n 1
ii obexftp 0.19-7ubuntu1 file transfer utility for devices that use the OBEX protocol

[Daniel T Chen (crimsun)]

Is this symptom still reproducible in 8.10 or 9.04?

[Mark Suter (suter-20080203)]

Daniel,

> Is this symptom still reproducible in 8.10 or 9.04?

It's reproducible on a freshly updated copy of Ubuntu 8.10.
Here's the trivial example of loosing date when the current
directly isn't writable:

    cd $(mktemp -d)
    chmod -w .
    obexftp -c E: -c Data -G important.csv

--
Mark Suter http://zwitterion.org/ | I have often regretted my
<email address hidden> | speech, never my silence.
mobile [phone] - gpg 2C71D63D | Xenocrates (396-314 B.C.)

[Kees Cook (kees)]

This appears to be a "regular" (non-security) bug. I have unmarked it as a security issue since this bug does not show evidence of allowing attackers to cross privilege boundaries nor directly cause loss of data/privacy. It is a rather nasty bug, though.