Your message dated Sat, 18 Aug 2012 19:02:40 +0000
with message-id <[email protected]>
and subject line Bug#682825: fixed in phpgacl 3.3.7-7.3
has caused the Debian Bug report #682825,
regarding phpgacl: creates world writable directory
/usr/share/phpgacl/admin/templates_c
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
682825: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=682825
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: phpgacl
Version: 3.3.7-7.2
Severity: grave
Tags: security
Justification: user security hole
User: [email protected]
Usertags: piuparts
Hi,
phpgacl creates the following directory upon installation:
drwxrwxrw- 2 root www-data 40 Jun 17 17:48
/usr/share/phpgacl/admin/templates_c
The postinst has the following code to do this:
# Ensure the templates_c directory needed by smarty is writable by www-data
if [ ! -x /usr/sbin/dpkg-statoverride ] || \
! dpkg-statoverride --list /usr/share/phpgacl/admin/templates_c > /dev/null
then
chown root:www-data /usr/share/phpgacl/admin/templates_c
chmod -R 776 /usr/share/phpgacl/admin/templates_c
fi
There is no indication why this is world writable.
0775 or 0770 should be sufficient.
Even if an ordinary local user cannot list the contents of the
directory, he may correctly derive/guess filenames (unless they are
exclusively $(mktemp)) and delete and replace files in there.
I don't know how phpgacl works, how it uses this directory, what
probelms could possibly arise out of this.
I just wrote the piuparts test for finding world writable directories :-)
Andreas
--- End Message ---
--- Begin Message ---
Source: phpgacl
Source-Version: 3.3.7-7.3
We believe that the bug you reported is fixed in the latest version of
phpgacl, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
gregor herrmann <[email protected]> (supplier of updated phpgacl package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Format: 1.8
Date: Thu, 16 Aug 2012 20:26:26 +0200
Source: phpgacl
Binary: phpgacl
Architecture: source all
Version: 3.3.7-7.3
Distribution: unstable
Urgency: low
Maintainer: David Gil <[email protected]>
Changed-By: gregor herrmann <[email protected]>
Description:
phpgacl - PHP Generic Access Control Lists
Closes: 646540 682825
Changes:
phpgacl (3.3.7-7.3) unstable; urgency=low
.
* Non-maintainer upload.
* Fix "uninstallable in sid, needs to transition to smarty3":
part 2 of the transition: fix smarty_dir variable in gacl.ini.php,
point to smarty3 directory
(Closes: #646540)
* Fix "creates world writable directory
/usr/share/phpgacl/admin/templates_c":
chmod it to 770 in postinst.
(Closes: #682825)
Checksums-Sha1:
2fdf33a452f8ab2f89e3e18b4ed9b22ae7db0023 1868 phpgacl_3.3.7-7.3.dsc
7349325aca69149ac9ea6585c207f09e87b14189 15632 phpgacl_3.3.7-7.3.diff.gz
dfb51efe598073eb792db2a2fbc2b807039da39d 1785760 phpgacl_3.3.7-7.3_all.deb
Checksums-Sha256:
4e39340e77790492ccbe7158c60e0158d5913431bf528ddf593104388fd8733d 1868
phpgacl_3.3.7-7.3.dsc
b68dc9b31ff9bf2057747483774838fadc88705070d95ed3074cd94f67bdc736 15632
phpgacl_3.3.7-7.3.diff.gz
a14e13fb18dc60c475d1ad9e4432b6b662d01b97df5c042173e1ca2e2c18c546 1785760
phpgacl_3.3.7-7.3_all.deb
Files:
3c02fd87890bd42b399b4f49e447673f 1868 web optional phpgacl_3.3.7-7.3.dsc
d6458482de081c0bcd8740109ff1ea6b 15632 web optional phpgacl_3.3.7-7.3.diff.gz
6a30d568593dcdfd2fc52614fac0e31b 1785760 web optional phpgacl_3.3.7-7.3_all.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
iQIcBAEBCAAGBQJQLT2FAAoJELs6aAGGSaoGSzIQAISwenccVzrfgR2Mkw4ZOMEb
6jCdpXqVRvMiMIRHrm/JzGqwk8HnEVLyswteKqh1qmr/w2TR1fozugc2qSwKkf+N
/f4Wn6M1rY+kwRyr0c9CBFInNXH5dhWIw+KYpDf1dFQhy2mFROYAnKFRl/d5FOA0
jzU3R23VRLNlJRrCUxr8nyz3gINmszFr4GA7fTLItbgBkEaJGKwR/uJ3y8BsoC5g
91t/fgA8VA33rVnCRbnIZSM9FjX2gBy7dLZQ+aAXDFd5pW8jm6GDdDZpSglUu/u7
0gaMm7gNskM7oeoG7mWai6LOSwYcEcEHRZoKh0Z0hbTzhSP2T3Tf+feZj9L9NAf/
fzzY6xUOHqMkJqWNBUWeVdTYu3Ihl6Imd/5Y50Weqipw0O4PcMHXJVBZd9tQOd2c
TekeNLHynittdSIpF9URaTaUkh8p5uixQuF/E93kVIxcrg0B4UgKxs31hDjU3O7k
5K1t02cEI99oNTc6Ui3nl7qwJFr3psj33ltBdLKsnUrtPJNI3+4M46sXAhVCvSqn
VTtUc75l3rHA7uvwYF7A0LHQnEYuIIFA2g8pQ5gb4BoxuL5bIN2kN0IqYcgJ0ntj
c2PRWVzVlaR8mCIw2uG9LJfX7JuBnqiI6IocCxfLQirLk+ZOHxwL/EfUZ68Y7Soc
Yradq6tPXguz1ZlUZmo4
=zkwy
-----END PGP SIGNATURE-----
--- End Message ---
