ekiga attempts to load a library from /tmp

[Robert Collins]

Binary package hint: ekiga

I was debugging the stock build of ekiga a little and I noticed this gem:
stat("/tmp/ekiga_test", 0x7fffc8be5be0) = -1 ENOENT (No such file or directory)
stat("/tmp/ekiga_test.so", 0x7fffc8be5be0) = -1 ENOENT (No such file or directory)
stat("/tmp/ekiga_test.la", 0x7fffc8be5be0) = -1 ENOENT (No such file or directory)
open("/tmp/ekiga_test.so", O_RDONLY) = -1 ENOENT (No such file or directory)

I suspect its trivially exploitable to run code as ekiga, which would be bad on multi user machines.

ProblemType: Bug
DistroRelease: Ubuntu 11.04
Package: ekiga 3.2.7-2ubuntu2
ProcVersionSignature: Ubuntu 2.6.38-9.43-generic 2.6.38.4
Uname: Linux 2.6.38-9-generic x86_64
Architecture: amd64
Date: Thu Jun 2 14:48:42 2011
ProcEnviron:
 LANGUAGE=la_AU:en
 PATH=(custom, user)
 LANG=en_AU.UTF-8
 LC_MESSAGES=la_AU.UTF-8
 SHELL=/bin/bash
SourcePackage: ekiga
UpgradeStatus: Upgraded to natty on 2011-04-28 (34 days ago)

[Robert Collins (lifeless)]

Start reading here:
http://bazaar.launchpad.net/~ubuntu-branches/ubuntu/oneiric/ekiga/oneiric/view/head:/lib/engine/plugin/plugin-core.cpp#L64

[Kees Cook (kees)]

Well that's no good. I've assigned this as CVE-2011-1830.

According to the git history, this was introduced in Ekiga 3.2.0 viadbc6837121c6546bcf057a9e5ee7b2239b1591ad and moved to the DEBUG builds in Ekiga 3.3.0 via 38b4cc81bd5520852a69d560ef5be4df41e7bb6e.

http://git.gnome.org/browse/ekiga/log/lib/engine/plugin/plugin-core.cpp

[Kees Cook (kees)]

Thanks again for the report! Since the package referred to in this bug is in universe or multiverse, it is community maintained. If you are able, I suggest posting a debdiff for this issue. When a debdiff is available, members of the security team will review it and publish the package. See the following link for more information: https://wiki.ubuntu.com/SecurityTeam/UpdateProcedures

[Ruben (info-rubenfelix)]

Hey!

Bedankt voor je mail! Ik ben er even tussenuit geknepen naar een lekker warm land! Ik beantwoord je mail na mijn vakantie (11 oktober).

Groetjes!

Ruben

[Reinier Strobos (rstrobos)]

Fix was included in upstream on the last upload.

[Jamie Strandboge (jdstrand)]

Thank you for reporting this bug to Ubuntu. maverick has reached EOL
(End of Life) and is no longer supported. As a result, this bug
against maverick is being marked "Won't Fix". Please see
https://wiki.ubuntu.com/Releases for currently supported Ubuntu
releases.

Please feel free to report any other bugs you may find.

[Jamie Strandboge (jdstrand)]

Thank you for reporting this bug to Ubuntu. natty has reached EOL
(End of Life) and is no longer supported. As a result, this bug
against natty is being marked "Won't Fix". Please see
https://wiki.ubuntu.com/Releases for currently supported Ubuntu
releases.

Please feel free to report any other bugs you may find.

[Rolf Leggewie (r0lf)]

lucid has seen the end of its life and is no longer receiving any updates. Marking the lucid task for this ticket as "Won't Fix".