Bug#496363: The possibility of attack with the help of symlinks in some Debian packages

2008-08-27 Thread Thijs Kinkhorst
Hi Dirk, On Monday 25 August 2008 13:57, Dirk Eddelbuettel wrote: Upstream covers more than just Linux distros: Aix, Solaris, OS X, HP-UX, ... and even Windoze (though the javareconf script may not matter there). But I just emailed the point person for javareconf. Maybe we can move creation

Bug#496363: The possibility of attack with the help of symlinks in some Debian packages

2008-08-27 Thread Dirk Eddelbuettel
Hi Thijs, On 27 August 2008 at 13:57, Thijs Kinkhorst wrote: | Hi Dirk, | | On Monday 25 August 2008 13:57, Dirk Eddelbuettel wrote: | Upstream covers more than just Linux distros: Aix, Solaris, OS X, HP-UX, | ... and even Windoze (though the javareconf script may not matter there). | | But

Bug#496363: The possibility of attack with the help of symlinks in some Debian packages

2008-08-25 Thread Thijs Kinkhorst
Trouble is that we then accumulate yet another Debian-only patch... Oh well. Why wouldn't it be acceptable to upstream? So something like # test functionality of the compiler javac_works='not present' if test -n $JAVAC; then javac_works='not functional' #rm -rf /tmp/A.java

Bug#496363: The possibility of attack with the help of symlinks in some Debian packages

2008-08-25 Thread Nico Golde
Hi Dirk, * Dirk Eddelbuettel [EMAIL PROTECTED] [2008-08-25 13:06]: On 25 August 2008 at 04:11, Nico Golde wrote: | * Dirk Eddelbuettel [EMAIL PROTECTED] [2008-08-25 03:07]: [...] | Right before /tmp/A.* are being used, they are being wiped. No symlink | attack. | | Unless I hear

Bug#496363: The possibility of attack with the help of symlinks in some Debian packages

2008-08-25 Thread Dirk Eddelbuettel
On 25 August 2008 at 13:19, Thijs Kinkhorst wrote: | Trouble is that we then accumulate yet another Debian-only patch... Oh well. | | Why wouldn't it be acceptable to upstream? I'll talk to them but mktemp is not universal, is it? | So something like | | # test functionality of the

Bug#496363: The possibility of attack with the help of symlinks in some Debian packages

2008-08-25 Thread Thijs Kinkhorst
On Monday 25 August 2008 13:36, Dirk Eddelbuettel wrote: On 25 August 2008 at 13:19, Thijs Kinkhorst wrote: | Trouble is that we then accumulate yet another Debian-only patch... Oh | well. | | Why wouldn't it be acceptable to upstream? I'll talk to them but mktemp is not universal, is it?

Bug#496363: The possibility of attack with the help of symlinks in some Debian packages

2008-08-25 Thread Dirk Eddelbuettel
On 25 August 2008 at 13:44, Thijs Kinkhorst wrote: | On Monday 25 August 2008 13:36, Dirk Eddelbuettel wrote: | On 25 August 2008 at 13:19, Thijs Kinkhorst wrote: | | Trouble is that we then accumulate yet another Debian-only patch... Oh | | well. | | | | Why wouldn't it be acceptable to

Bug#496363: The possibility of attack with the help of symlinks in some Debian packages

2008-08-24 Thread Dirk Eddelbuettel
I think it is a false positive: # test functionality of the compiler javac_works='not present' if test -n $JAVAC; then javac_works='not functional' rm -rf /tmp/A.java /tmp/A.class ## - note the rm -rf echo public class A { } /tmp/A.java if test -e /tmp/A.java; then

Bug#496363: The possibility of attack with the help of symlinks in some Debian packages

2008-08-24 Thread Nico Golde
Hi Dirk, * Dirk Eddelbuettel [EMAIL PROTECTED] [2008-08-25 03:07]: I think it is a false positive: # test functionality of the compiler javac_works='not present' if test -n $JAVAC; then javac_works='not functional' rm -rf /tmp/A.java /tmp/A.class ## - note the rm -rf

Bug#496363: The possibility of attack with the help of symlinks in some Debian packages

2008-08-24 Thread Dirk Eddelbuettel
On 25 August 2008 at 04:11, Nico Golde wrote: | Hi Dirk, | * Dirk Eddelbuettel [EMAIL PROTECTED] [2008-08-25 03:07]: | I think it is a false positive: | | # test functionality of the compiler | javac_works='not present' | if test -n $JAVAC; then | javac_works='not functional' | rm

Bug#496363: The possibility of attack with the help of symlinks in some Debian packages

2008-08-24 Thread Dmitry E. Oboukhov
Package: r-base-core-ra Severity: grave Hi, maintainer! This message about the error concerns a few packages at once. I've tested all the packages (for Lenny) on my Debian mirror. All scripts of packages (marked as executable) were tested. In some packages I've discovered scripts with