Package: docbookwiki
Version: 0.9.1cvs-14
Severity: grave
Tags: security
Hi,
There's a race condition in the postrm script that could let a user get a copy
of the sudoers file while the package is being purged.
Vulnerable code:
> sed -e '/allow apache to run everything as dbwiki/{N;d;p}' < /etc/sudoers >
/etc/sudoers.new
> mv -f /etc/sudoers.new /etc/sudoers
> chmod 0440 /etc/sudoers
Cheers,
--
Raphael Geissert - Debian Developer
www.debian.org - get.debian.net
--
To UNSUBSCRIBE, email to [email protected]
with a subject of "unsubscribe". Trouble? Contact [email protected]
