[gentoo-commits] gentoo-x86 commit in app-emulation/xen-tools/files: xen-tools-3.1.1-insecure-file-creation-fix.patch digest-xen-tools-3.1.0-r2 digest-xen-tools-3.1.1-r1 digest-xen-tools-3.0.4_p1-r2 digest-xen-tools-3.1.0-r1 digest-xen-tools-3.1.1 digest-xen-tools-3.0.4_p1-r1

[Micheal Marineau (marineam)]

marineam    07/10/23 19:09:10

  Added:                xen-tools-3.1.1-insecure-file-creation-fix.patch
                        digest-xen-tools-3.1.0-r2 digest-xen-tools-3.1.1-r1
                        digest-xen-tools-3.0.4_p1-r2
  Removed:              digest-xen-tools-3.1.0-r1 digest-xen-tools-3.1.1
                        digest-xen-tools-3.0.4_p1-r1
  Log:
  Security fix
  (Portage version: 2.1.3.9)

Revision  Changes    Path
1.1                  app-emulation/xen-tools/files/xen-tools-3.1.1-insecure-file-creation-fix.patch

file : http://sources.gentoo.org/viewcvs.py/gentoo-x86/app-emulation/xen-tools/files/xen-tools-3.1.1-insecure-file-creation-fix.patch?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewcvs.py/gentoo-x86/app-emulation/xen-tools/files/xen-tools-3.1.1-insecure-file-creation-fix.patch?rev=1.1&content-type=text/plain

Index: xen-tools-3.1.1-insecure-file-creation-fix.patch
===================================================================

# HG changeset patch
# User Keir Fraser <keir@×××××××××.com>
# Date 1193128003 -3600
# Node ID b28ae5f00553ea053bd4e4576634d8ea49e77bc3
# Parent 118a21c66fd53a08d7191159e5b2888f8d9e4ad2
xenmon: Fix security vulnerability CVE-2007-3919.

The xenbaked daemon and xenmon utility communicate via a mmap'ed
shared file. Since this file is located in /tmp, unprivileged users
can cause arbitrary files to be truncated by creating a symlink from
the well-known /tmp filename to e.g., /etc/passwd.

The fix is to place the shared file in a directory to which only root
should have access (in this case /var/run/).

This bug was reported, and the fix suggested, by Steve Kemp
<skx@××××××.org>. Thanks!

Signed-off-by: Keir Fraser <keir@×××××××××.com>

--- a/tools/xenmon/xenbaked.c	Mon Oct 22 21:06:11 2007 +0100
+++ b/tools/xenmon/xenbaked.c	Tue Oct 23 09:26:43 2007 +0100
@@ -589,7 +589,7 @@ error_t cmd_parser(int key, char *arg, s
     return 0;
 }
 
-#define SHARED_MEM_FILE "/tmp/xenq-shm"
+#define SHARED_MEM_FILE "/var/run/xenq-shm"
 void alloc_qos_data(int ncpu)
 {
     int i, n, pgsize, off=0;
--- a/tools/xenmon/xenmon.py	Mon Oct 22 21:06:11 2007 +0100
+++ b/tools/xenmon/xenmon.py	Tue Oct 23 09:26:43 2007 +0100
@@ -46,7 +46,7 @@ QOS_DATA_SIZE = struct.calcsize(ST_QDATA
 QOS_DATA_SIZE = struct.calcsize(ST_QDATA)*NSAMPLES + struct.calcsize(ST_DOM_INFO)*NDOMAINS + struct.calcsize("4i")
 
 # location of mmaped file, hard coded right now
-SHM_FILE = "/tmp/xenq-shm"
+SHM_FILE = "/var/run/xenq-shm"
 
 # format strings
 TOTALS = 15*' ' + "%6.2f%%" + 35*' ' + "%6.2f%%"




1.1                  app-emulation/xen-tools/files/digest-xen-tools-3.1.0-r2

file : http://sources.gentoo.org/viewcvs.py/gentoo-x86/app-emulation/xen-tools/files/digest-xen-tools-3.1.0-r2?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewcvs.py/gentoo-x86/app-emulation/xen-tools/files/digest-xen-tools-3.1.0-r2?rev=1.1&content-type=text/plain

Index: digest-xen-tools-3.1.0-r2
===================================================================
MD5 b7ae1f652b071862ae4c90b72d549627 xen-3.1.0-src.tgz 6831094
RMD160 2fd65a3b81e522d0ed2d62fd11e5977167f1ceb3 xen-3.1.0-src.tgz 6831094
SHA256 b5d7cea6deeee1439e8883fed4b3f1a8e4f675b4af8148178721f99bd76676b7 xen-3.1.0-src.tgz 6831094



1.1                  app-emulation/xen-tools/files/digest-xen-tools-3.1.1-r1

file : http://sources.gentoo.org/viewcvs.py/gentoo-x86/app-emulation/xen-tools/files/digest-xen-tools-3.1.1-r1?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewcvs.py/gentoo-x86/app-emulation/xen-tools/files/digest-xen-tools-3.1.1-r1?rev=1.1&content-type=text/plain

Index: digest-xen-tools-3.1.1-r1
===================================================================
MD5 d5bafac9c819206d6a85c11352cc90fd xen-3.1.1.tgz 6868014
RMD160 23f522a76815a64ba18eaf9eec19f38ea01e8c32 xen-3.1.1.tgz 6868014
SHA256 c6c986177e75e41e7412920d453b5b759568a90266b09e2fea6043f8890f75e2 xen-3.1.1.tgz 6868014



1.1                  app-emulation/xen-tools/files/digest-xen-tools-3.0.4_p1-r2

file : http://sources.gentoo.org/viewcvs.py/gentoo-x86/app-emulation/xen-tools/files/digest-xen-tools-3.0.4_p1-r2?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewcvs.py/gentoo-x86/app-emulation/xen-tools/files/digest-xen-tools-3.0.4_p1-r2?rev=1.1&content-type=text/plain

Index: digest-xen-tools-3.0.4_p1-r2
===================================================================
MD5 e85e16ad3dc354338e3ac4a8951f9649 xen-3.0.4_1-src.tgz 6473636
RMD160 f869eec35f6afe0bc9824ce2eb4a600f789d423b xen-3.0.4_1-src.tgz 6473636
SHA256 6b3842393e69a9c8fcdbc2789d05830aba6f1d108a6f97f1448de4a86f92a5cb xen-3.0.4_1-src.tgz 6473636



-- 
gentoo-commits@g.o mailing list