CVE-2007-6131: Low severity redhat Fedora Core vulnerability

Description of problem:

scanbuttond, as packaged, runs as a root owned process. Despite of that in /etc/scanbuttond/buttonpressed.sh one can find

TMPFILE="/tmp/scan.pnm" TMPJPGFILE="/tmp/scan.jpg"

Not even a need to race to guess those file names and that script, executed by scanbuttond, writes there. Security implications are obvious and 'mktemp' exists for a reason. As things stand now there is not even a feeble attempt to remove possibly existing files/links before trying to write to those.

Moreover 'cleanup' function is not trapped which means that there will be leftovers on an abnormal exit. At least something of that sort should be present

trap 'cleanup; exit' TERM INT QUIT KILL EXIT

before any of temporaries are created.

On the top of all the above it is highly doubtful that this script should be run by root as one of system services. Do you really want to try to run on a root behalf things like editcmd() { gimp $TMPFILE } or send some email with attachments? I guess that one of simple possible solutions would be to add a startup file in /etc/profile.d/ which would check for a presence of $DISPLAY (does not seem to much point of running that otherwise in general - at least without writing quite a different script) and that other instance of scanbuttond is not already running and launch that for a user. Other possibilty which comes to mind is to register a startup as one of seesions scripts.

Version-Release number of selected component (if applicable): scanbuttond-0.2.3-10.fc7

— Red Hat