CVE-2011-1920

First published: Mon May 16 2011(Updated: )

A Debian bug report [1] noted that pmake (and mk-files in Fedora) contained the files /usr/share/mk/bsd.{lib,prog}.mk that created temporary files insecurely with predictable file names in /tmp (/tmp/_depend[PID]), ignoring any $TMPDIR values. In lib.mk: 446 afterdepend: .depend 447 @(TMP=/tmp/_depend$$$$; \ 448 sed -e 's/^\([^\.]*\).o[ ]*:/\1.o \1.po \1.so \1.ln:/' \ 449 &lt; .depend &gt; $$TMP; \ 450 mv $$TMP .depend) 451 .endif The same is found in prog.mk (in Fedora's mk-files package). The Debian bug report proposes to use mktemp here: - @(TMP=/tmp/_depend$$$$; \ + @(TMP=`mktemp -t _dependXXXXXXXXXX` || exit $$?; \ Upstream has already corrected this by removing the offending code [2],[3]. [1] <a href="http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=626673">http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=626673</a> [2] <a href="http://cvsweb.netbsd.org/bsdweb.cgi/src/share/mk/bsd.lib.mk.diff?r1=1.239&amp;r2=1.240">http://cvsweb.netbsd.org/bsdweb.cgi/src/share/mk/bsd.lib.mk.diff?r1=1.239&amp;r2=1.240</a> [3] <a href="http://cvsweb.netbsd.org/bsdweb.cgi/src/share/mk/bsd.prog.mk.diff?r1=1.192&amp;r2=1.193">http://cvsweb.netbsd.org/bsdweb.cgi/src/share/mk/bsd.prog.mk.diff?r1=1.192&amp;r2=1.193</a>

Credit: secalert@redhat.com

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• collector/nvd-historical
• agent/type
• agent/first-publish-date
• collector/nvd-index
• agent/software-canonical-lookup-request
• agent/weakness
• agent/severity
• agent/references
• agent/author
• agent/remedy
• agent/softwarecombine
• agent/description
• collector/mitre-cve
• source/MITRE
• agent/last-modified-date
• collector/redhat-bugzilla
• source/Red Hat
• alias/CVE-2011-1920
• agent/tags
• agent/event
• agent/trending
• vendor/netbsd
• canonical/netbsd netbsd
• version/netbsd netbsd/1.6.1
• version/netbsd netbsd/1.0
• version/netbsd netbsd/1.1
• version/netbsd netbsd/1.2
• version/netbsd netbsd/1.2.1
• version/netbsd netbsd/1.3
• version/netbsd netbsd/1.3.1
• version/netbsd netbsd/1.3.2
• version/netbsd netbsd/1.3.3
• version/netbsd netbsd/1.4
• version/netbsd netbsd/1.4.1
• version/netbsd netbsd/1.4.2
• version/netbsd netbsd/1.4.3
• version/netbsd netbsd/1.5
• version/netbsd netbsd/1.5.1
• version/netbsd netbsd/1.5.2
• version/netbsd netbsd/1.5.3
• version/netbsd netbsd/1.6
• vendor/ihji
• canonical/ihji pmake
• version/ihji pmake/1.111