oss-sec mailing list archives

Re: Bug#744817: CVE request: insecure temporary file handling in clang's scan-build utility

From: Sylvestre Ledru <sylvestre () debian org>
Date: Mon, 16 Jun 2014 23:00:21 +0200

On 16/06/2014 22:51, Sylvestre Ledru wrote:

On 19/04/2014 05:29, cve-assign () mitre org wrote:

Jakub Wilk discovered that clang's scan-build utility insecurely handled
temporary files.
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=744817
The GetHTMLRunDir subroutine ...
3) The function doesn't fail if the directory already exists, even if
it's owned by another user.

Use CVE-2014-2893.

I think I fixed it upstream:
http://llvm.org/viewvc/llvm-project?view=revision&revision=211051
http://llvm.org/viewvc/llvm-project/cfe/trunk/tools/scan-build/scan-build?r1=210971&r2=211051&pathrev=211051

Actual patch fixed:
http://llvm.org/viewvc/llvm-project/cfe/trunk/tools/scan-build/scan-build?r1=210971&r2=211053&pathrev=211053
Sorry about the noise

Sylvestre

Attachment: signature.asc
Description: OpenPGP digital signature

Current thread:

CVE request: insecure temporary file handling in clang's scan-build utility Murray McAllister (Apr 15)
- Re: CVE request: insecure temporary file handling in clang's scan-build utility cve-assign (Apr 18)
  - Re: Bug#744817: CVE request: insecure temporary file handling in clang's scan-build utility Sylvestre Ledru (Apr 20)
  - Message not available
    - Re: Bug#744817: CVE request: insecure temporary file handling in clang's scan-build utility Sylvestre Ledru (Jun 16)