Bug 13081

Summary:	perltidy new security issue CVE-2014-2277
Product:	Mageia	Reporter:	David Walser <luigiwalser>
Component:	Security	Assignee:	QA Team <qa-bugs>
Status:	RESOLVED FIXED	QA Contact:	Sec team <security>
Severity:	normal
Priority:	Normal	CC:	cmrisolde, davidwhodgins, jquelin, pterjan, sysadmin-bugs, wilcal.int
Version:	4	Keywords:	validated_update
Target Milestone:	---
Hardware:	i586
OS:	Linux
URL:	http://lwn.net/Vulnerabilities/591680/
Whiteboard:	MGA3TOO has_procedure MGA4-32-OK MGA4-64-OK MGA3-32-OK MGA3-64-OK advisory
Source RPM:	perltidy-20121207.0.0-2.mga3.src.rpm	CVE:
Status comment:

Description David Walser 2014-03-24 19:21:22 CET

Fedora has issued an advisory on March 15:
https://lists.fedoraproject.org/pipermail/package-announce/2014-March/130479.html

The RedHat bug contains a link to a patch:
https://bugzilla.redhat.com/show_bug.cgi?id=1074720

Reproducible: 

Steps to Reproduce:

David Walser 2014-03-24 19:21:28 CET

Whiteboard: (none) => MGA4TOO, MGA3TOO

Comment 1 Jerome Quelin 2014-03-25 10:48:54 CET

Fixed in cauldron, package submitted & built for mga3 and mga4.
It's difficult to provide a test case, since it's basically a race condition that has been fixed.

Advisory:
==================================
perltidy's make_temporary_filename() function insecurely created temporary files via the use of the tmpnam() function. A local attacker could use this flaw to perform a symbolic link attack.
==================================

List of rpms/srpms:
- perltidy-20121207.0.0-3.1.mga4.noarch.rpm
- perltidy-20121207.0.0-3.1.mga4.src.rpm

- perltidy-20121207.0.0-2.1.mga3.noarch.rpm
- perltidy-20121207.0.0-2.1.mga3.src.rpm

Please test & push.

CC: (none) => jquelin
Assignee: jquelin => qa-bugs

Comment 2 David Walser 2014-03-25 11:19:32 CET

Thanks Jerome!

Advisory:
==================================

Updated perltidy package fixes security vulnerability:

perltidy's make_temporary_filename() function insecurely created temporary
files via the use of the tmpnam() function. A local attacker could use this
flaw to perform a symbolic link attack (CVE-2014-2277).

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2277
https://lists.fedoraproject.org/pipermail/package-announce/2014-March/130479.html

Version: Cauldron => 4
Whiteboard: MGA4TOO, MGA3TOO => MGA3TOO

Comment 3 Carolyn Rowse 2014-03-25 20:21:51 CET

Here's a link to a tutorial on perltidy:

http://perltidy.sourceforge.net/tutorial.html

I'll test it myself today or tomorrow hopefully, if real life gets in the way I'll let you know.

Carolyn

CC: (none) => cmrisolde
Whiteboard: MGA3TOO => MGA3TOO has_procedure

Comment 4 Carolyn Rowse 2014-03-26 20:04:03 CET

Mga4 32-bit fine.

Whiteboard: MGA3TOO has_procedure => MGA3TOO has_procedure MGA4-32-OK

Comment 5 Carolyn Rowse 2014-03-26 20:18:18 CET

Mga3 32-bit fine.

Please could someone do the 64-bit tests.

Thanks.

Carolyn

Whiteboard: MGA3TOO has_procedure MGA4-32-OK => MGA3TOO has_procedure MGA4-32-OK MGA3-32-OK

Comment 6 William Kenney 2014-03-27 18:32:14 CET

In VirtualBox, M3, KDE, 64-bit

Package(s) under test:
perltidy

default install of perltidy

[root@localhost wilcal]# urpmi perltidy
Package perltidy-20121207.0.0-2.mga3.noarch is already installed

Yup, perltidy tidy's up the test .pl file

install perltidy from updates_testing

[root@localhost wilcal]# urpmi perltidy
Package perltidy-20121207.0.0-2.1.mga3.noarch is already installed

Yup, perltidy is still tidy'n up the test .pl file

Test platform:
Intel Core i7-2600K Sandy Bridge 3.4GHz
GIGABYTE GA-Z68X-UD3-B3 LGA 1155 MoBo
GIGABYTE GV-N440D3-1GI Nvidia GeForce GT 440 (Fermi) 1GB
RTL8111/8168B PCI Express 1Gbit Ethernet
DRAM 16GB (4 x 4GB)
Mageia 4 64-bit, Nvidia driver
VirtualBox 4.3.6-1.mga4.x86_64.rpm

CC: (none) => wilcal.int
Whiteboard: MGA3TOO has_procedure MGA4-32-OK MGA3-32-OK => MGA3TOO has_procedure MGA4-32-OK MGA3-64-OK MGA3-32-OK

Comment 7 William Kenney 2014-03-27 18:55:11 CET

In VirtualBox, M4, KDE, 64-bit

Package(s) under test:
perltidy

default install of perltidy

[root@localhost wilcal]# urpmi perltidy
Package perltidy-20121207.0.0-3.mga4.noarch is already installed

Yup, perltidy tidy's up the test .pl file

install perltidy from updates_testing

[root@localhost wilcal]# urpmi perltidy
Package perltidy-20121207.0.0-3.1.mga4.noarch is already installed

Yup, perltidy is still tidy'n up the test .pl file

Test platform:
Intel Core i7-2600K Sandy Bridge 3.4GHz
GIGABYTE GA-Z68X-UD3-B3 LGA 1155 MoBo
GIGABYTE GV-N440D3-1GI Nvidia GeForce GT 440 (Fermi) 1GB
RTL8111/8168B PCI Express 1Gbit Ethernet
DRAM 16GB (4 x 4GB)
Mageia 4 64-bit, Nvidia driver
VirtualBox 4.3.6-1.mga4.x86_64.rpm

Whiteboard: MGA3TOO has_procedure MGA4-32-OK MGA3-64-OK MGA3-32-OK => MGA3TOO has_procedure MGA4-32-OK MGA4-64-OK MGA3-32-OK MGA3-64-OK

Comment 8 William Kenney 2014-03-27 18:56:23 CET

For me this update works fine.
Testing complete for mga3 32-bit & 64-bit
Testing complete for mga4 32-bit & 64-bit
If everybody is happy could someone from the
sysadmin team push this to updates. Thanks

William Kenney 2014-03-27 20:35:35 CET

Keywords: (none) => validated_update
CC: (none) => sysadmin-bugs

Comment 9 Pascal Terjan 2014-03-31 21:50:32 CEST

There is no advisory in svn

CC: (none) => pterjan

Comment 10 Dave Hodgins 2014-03-31 22:09:46 CEST

Advisory committed to svn.

CC: (none) => davidwhodgins
Whiteboard: MGA3TOO has_procedure MGA4-32-OK MGA4-64-OK MGA3-32-OK MGA3-64-OK => MGA3TOO has_procedure MGA4-32-OK MGA4-64-OK MGA3-32-OK MGA3-64-OK advisory

Comment 11 Pascal Terjan 2014-03-31 23:17:14 CEST

http://advisories.mageia.org/MGASA-2014-0147.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED