Gentoo: GLSA-202107-03: libqb: Insecure temporary file | LinuxSecur...

Advisories

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory                           GLSA 202107-03
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                           https://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

 Severity: High
    Title: libqb: Insecure temporary file
     Date: July 03, 2021
     Bugs: #699860
       ID: 202107-03

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

An insecure temporary file usage has been reported in libqb possibly
allowing local code execution.

Background
==========

libqb is a library with the primary purpose of providing
high-performance, reusable features for client-server architecture,
such as logging, tracing, inter-process communication (IPC), and
polling.

Affected packages
=================

    -------------------------------------------------------------------
     Package              /     Vulnerable     /            Unaffected
    -------------------------------------------------------------------
  1  sys-cluster/libqb            < 1.0.5                    >= 1.0.5 

Description
===========

It was discovered that libqb used predictable filenames (under /dev/shm
and /tmp) without O_EXCL.

Impact
======

A local attacker could perform symlink attacks to overwrite arbitrary
files with the privileges of the user running the application linked
against libqb.

Workaround
==========

There is no known workaround at this time.

Resolution
==========

All libqb users should upgrade to the latest version:

  # emerge --sync
  # emerge --ask --oneshot --verbose ">=sys-cluster/libqb-1.0.5"

References
==========

[ 1 ] CVE-2019-12779
      https://nvd.nist.gov/vuln/detail/CVE-2019-12779

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

 https://security.gentoo.org/glsa/202107-03

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
[email protected] or alternatively, you may file a bug at
https://bugs.gentoo.org.

License
=======

Copyright 2021 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

https://creativecommons.org/licenses/by-sa/2.5

Gentoo: GLSA-202107-03: libqb: Insecure temporary file

Summary

It was discovered that libqb used predictable filenames (under /dev/shm and /tmp) without O_EXCL.

Resolution

All libqb users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-cluster/libqb-1.0.5"

References

[ 1 ] CVE-2019-12779 https://nvd.nist.gov/vuln/detail/CVE-2019-12779

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website:
https://security.gentoo.org/glsa/202107-03

Concerns

Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to [email protected] or alternatively, you may file a bug at https://bugs.gentoo.org.

Severity
Severity: High
Title: libqb: Insecure temporary file
Date: July 03, 2021
Bugs: #699860
ID: 202107-03

Synopsis

An insecure temporary file usage has been reported in libqb possibly allowing local code execution.

Background

libqb is a library with the primary purpose of providing high-performance, reusable features for client-server architecture, such as logging, tracing, inter-process communication (IPC), and polling.

Affected Packages

------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 sys-cluster/libqb < 1.0.5 >= 1.0.5

Impact

A local attacker could perform symlink attacks to overwrite arbitrary files with the privileges of the user running the application linked against libqb.

Workaround

There is no known workaround at this time.

We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.