There is now conky-1.8.1-1.1.mga1 in core/updates_testing to validate ------------------------------------------------------- Suggested advisory: ------------------- This update addresses the following CVE: - CVE-2011-3616 The getSkillname function in the eve module in Conky 1.8.1 and earlier allows local users to overwrite arbitrary files via a symlink attack on /tmp/.cesf. In the getSkillname() function of the Eve plugin, there is a race condition between when the plugin checks for the existence of /tmp/.cesf and when it writes to the file, easily beaten because getXmlFromAPI() is called in between (which can take time due to network latency, etc.). If a user were able to beat the race and create a symlink of /tmp/.cesf to any file the user running conky had write access to, they could overwrite the contents of that file. http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3616 https://bugzilla.redhat.com/show_bug.cgi?id=676367 ------------------------------------------------------- Steps to reproduce: - install/update to update candidate
Status: NEW => ASSIGNEDCC: (none) => doktor5000Assignee: bugsquad => qa-bugs
Testing complete on i586 for the srpm conky-1.8.1-1.1.mga1.src.rpm Running under strace confirms the /tmp.cesf file is no longer used.
CC: (none) => davidwhodgins
Can someone please test this for x86_64?
I have installed the srpm conky-1.8.1-1.1.mga1.src.rpm but I don't know what to do with this one.
CC: (none) => geiger.david68210
Run conky. Click on the show desktop icon, and the system monitor will be visible on the desktop. Confirm the /tmp.cesf file does not exist.
Testing complete on Mageia release 1 (Official) for x86_64 ,works for me too. http://www.siteduzero.com/tutoriel-3-215060-installer-et-configurer-conky.html I can confirm the /tmp.cesf file doesn't exist . Thank you Dave.
Validating the update. Could someone from the sysadmin team push the srpm conky-1.8.1-1.1.mga1.src.rpm from Core Updates Testing to Core Updates. Advisory: This security update for conky addresses CVE-2011-3616 The getSkillname function in the eve module in Conky 1.8.1 and earlier allows local users to overwrite arbitrary files via a symlink attack on /tmp/.cesf. In the getSkillname() function of the Eve plugin, there is a race condition between when the plugin checks for the existence of /tmp/.cesf and when it writes to the file, easily beaten because getXmlFromAPI() is called in between (which can take time due to network latency, etc.). If a user were able to beat the race and create a symlink of /tmp/.cesf to any file the user running conky had write access to, they could overwrite the contents of that file. http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3616 https://bugzilla.redhat.com/show_bug.cgi?id=676367 https://bugs.mageia.org/show_bug.cgi?id=4058
Keywords: (none) => validated_updateCC: (none) => sysadmin-bugs
update pushed
Status: ASSIGNED => RESOLVEDCC: (none) => tmbResolution: (none) => FIXED