[CVE-2008-1614] privilege escalation via symlink attack

[William Grant]

CVE-2008-1614 appears to affect all releases:

"suPHP before 0.6.3 allows local users to gain privileges via (1) a race condition that involves multiple symlink changes to point a file owned by a different user, or (2) a symlink to the directory of a different user, which is used to determine privileges."

[William Grant (wgrant)]

Here's a debdiff for Hardy. I need a MOTU Release ack for this.

[StefanPotyra (sistpoty)]

ACK for hardy.

[Launchpad Janitor (janitor)]

This bug was fixed in the package suphp - 0.6.2-2ubuntu1

---------------
suphp (0.6.2-2ubuntu1) hardy; urgency=low

  * SECURITY UPDATE: privilege escalation via race condition (LP: #216245)
    - debian/patches/10_CVE-2008-1614.dpatch: Fix race condition in symlink
      handling. Patch from Debian.
    - References:
      + CVE-2008-1614
  * Modify Maintainer value to match the DebianMaintainerField
    specification.

 -- William Grant <email address hidden> Sat, 19 Apr 2008 21:12:27 +1000

[Hew (hew)]

Ubuntu Edgy Eft is no longer supported, so a SRU will not be issued for this release. Marking Edgy as Won't Fix.

[Hew (hew)]

Ubuntu Feisty Fawn is no longer supported, so a SRU will not be issued for this release. Marking Feisty as Won't Fix.

[Sergio Zanchetta (primes2h)]

The 18 month support period for Gutsy Gibbon 7.10 has reached its end of life -
http://www.ubuntu.com/news/ubuntu-7.10-eol . As a result, we are closing the
Gutsy task.

[Jamie Strandboge (jdstrand)]

Thank you for reporting this bug to Ubuntu. dapper has reached EOL
(End of Life) and is no longer supported. As a result, this bug
against dapper is being marked "Won't Fix". Please see
https://wiki.ubuntu.com/Releases for currently supported Ubuntu
releases.

Please feel free to report any other bugs you may find.