304330 - CVE-2005-2353 run-mozilla.sh temporary file issue

Status: RESOLVED FIXED

Description

[Josh Bressers]

An Ubuntu security advisory fixed a temporary file vulnerability in the
run-mozilla.sh script when run in debug mode.

The run-mozilla.sh script passes gdb arguments from a temporary file which is
named in a manner that makes it fairly easy to guess.  The temporary file should
be created using the mktemp program to ensure proper file permissions and a
unique filename.

Comment 1

[Josh Bressers]

Created attachment 192382 [details] [diff] [review]
Suggested fix for this issue

Comment 2

[Frederic Crozat]

Different patch was originally submitted by the author of the original bug :

http://bugs.debian.org/cgi-bin/bugreport.cgi/mozilla-thunderbird-1.0.diff?bug=306893;msg=5;att=1

Comment 3

[Daniel Veditz [:dveditz]]

Nominating for a closer look based on Frederic's mail.

Comment 4

[Mike Schroepfer]

Is the patch effective? Running out of time for 1.5b2 . .. 

Comment 5

[Mike Schroepfer]

DBaron - need SR here.

Comment 6

[David Baron :dbaron: ⌚️UTC-7]

Comment on attachment 192382 [details] [diff] [review]
Suggested fix for this issue

This patch doesn't actually work because of the spaces around the equals sign
in this line:

>+        mozargs_temp = `mktemp /tmp/mozargs.XXXXXX`

If you fix that, then it works, so sr=dbaron, conditional on removing those two
spaces.

Comment 7

[David Baron :dbaron: ⌚️UTC-7]

That said, I think the patch in comment 2 is preferable (except with the
whitespace cleaned up), both because it uses mktemp -t and because it removes
the temporary file under more conditions.

Comment 8

[Asa Dotzler [:asa]]

Comment on attachment 192382 [details] [diff] [review]
Suggested fix for this issue

please re-request approval when you've got a fully reviewed patch.

Comment 9

[Asa Dotzler [:asa]]

Dbaron, can you get that earlier patch in? This bug is stalled and we seem to
want it for beta2.

Comment 10

[Daniel Veditz [:dveditz]]

(In reply to comment #9)
> Dbaron, can you get that earlier patch in? This bug is stalled and we seem to
> want it for beta2.

I was actually about to check this in

Comment 11

[Daniel Veditz [:dveditz]]

fix checked into trunk

Comment 12

[[e-mail]]

Note: RH7.3 doesn't have mktemp -t

Comment 13

[Daniel Veditz [:dveditz]]

dropped -t and went back to mktemp /tmp/mozargs.XXXXXX

fix checked into the 1.8 branch

Comment 14

[Frederic Crozat]

Any hope to get it landed on on 1.0.x aviary branch too ?