On Sun, Jul 06, 2014 at 11:49:26PM +0200, Jakub Wilk wrote: > Package: apt > Version: 1.1~exp1 > Severity: minor > Tags: security
Thanks for your bugreport. > First of all, thanks for bringing new exciting features to apt! > > I'm afraid, however, that one of these features, namely > * add support for "apt-get build-dep unpacked-source-dir" > brought an unanticipated security regression. > > Consider the following command: > > # apt-get build-dep nyancat > > It used to be safe to execute it regardless of what your working > directory was. But in apt_1.1~exp1, this is no longer secure if cwd > is a world-writable, for example /tmp. A local malicious user could > create crafted /tmp/nyancat/debian/control, tricking apt into > installing packages of their choice. Or they could symlink > /tmp/nyancat/debian/control to /dev/urandom... Good point, thanks a lot for bring this to our attention. I changed the code now so that it prints when using a file/directory so that the user is aware of it (as suggested by David). And as you suggested it now enforces that it needs a path starting with ./ or /. Thanks, Michael > -- System Information: > Debian Release: jessie/sid > APT prefers unstable > APT policy: (990, 'unstable'), (500, 'experimental') > Architecture: i386 (x86_64) > Foreign Architectures: amd64 > > Kernel: Linux 3.14-1-amd64 (SMP w/2 CPU cores) > Locale: LANG=C, LC_CTYPE=pl_PL.UTF-8 (charmap=UTF-8) > Shell: /bin/sh linked to /bin/dash > > Versions of packages apt depends on: > ii debian-archive-keyring 2012.4 > ii gnupg 1.4.18-1 > ii libapt-pkg4.13 1.1~exp1 > ii libc6 2.19-4 > ii libgcc1 1:4.9.0-10 > ii libstdc++6 4.9.0-10 > > -- > Jakub Wilk > > > -- > To UNSUBSCRIBE, email to deity-requ...@lists.debian.org > with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org > Archive: https://lists.debian.org/20140706214926.ga8...@jwilk.net > -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
