#33150 [Asn->Csd]: shtool: insecure temporary file creation

From:	sniper@php.net	Date:	Sat, 18 Jun 2005 18:57:47 +0000
Subject:	#33150 [Asn->Csd]: shtool: insecure temporary file creation
References:	1	Groups:	php.bugs
Request:	Send a blank email to php-bugs+get-80588@lists.php.net to get a copy of this message

 ID:               33150
 Updated by:       sniper@php.net
 Reported By:      eromang at zataz dot net
-Status:           Assigned
+Status:           Closed
 Bug Type:         Compile Failure
 Operating System: UNIX
 PHP Version:      5.*, 4.*
 Assigned To:      sniper
 New Comment:

This bug has been fixed in CVS.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
 
Thank you for the report, and for helping us make PHP better.




Previous Comments:
------------------------------------------------------------------------

[2005-06-18 20:57:32] sniper@php.net

We use the 'path' command also, and that one is affected.


------------------------------------------------------------------------

[2005-06-10 17:18:20] koon at gentoo dot org

Apparently PHP only uses the mkdir and echo commands, neither makes a
tmpfile. SO you probably aren't affected by this currently.

------------------------------------------------------------------------

[2005-05-30 01:02:05] sniper@php.net

We'll update the bundled shtool as soon as they release new version of
it. We will not start patching it ourselves.



------------------------------------------------------------------------

[2005-05-29 22:25:54] eromang at zataz dot net

Hello,

Here under the patch proposal from Gentoo Security Team.

https://bugs.gentoo.org/attachment.cgi?id=60117

CAN-2005-1751

Regards.

------------------------------------------------------------------------

[2005-05-26 13:43:40] eromang at zataz dot net

Description:
------------
Hello,

php is using a vulnerable version of shtool.

For more informations :

http://www.securityfocus.com/bid/13767?ref=rss

Regards



------------------------------------------------------------------------


-- 
Edit this bug report at http://bugs.php.net/?id=33150&edit=1


   

Thread (9 messages)

• eromang at zataz dot netThu, 26 May 2005 11:43:41 +0000
  • eromang at zataz dot netThu, 26 May 2005 11:56:01 +0000#33150 [Opn]: shtool php insecure temporary file creation
  • tony2001@php.netThu, 26 May 2005 12:59:10 +0000#33150 [Opn->Fbk]: shtool php insecure temporary file creation
  • koon at gentoo dot orgSun, 29 May 2005 10:48:28 +0000#33150 [Com]: shtool php insecure temporary file creation
  • eromang at zataz dot netSun, 29 May 2005 20:25:55 +0000#33150 [Fbk->Opn]: shtool php insecure temporary file creation
  • sniper@php.netSun, 29 May 2005 23:02:06 +0000#33150 [Opn->Asn]: shtool php insecure temporary file creation
  • koon at gentoo dot orgFri, 10 Jun 2005 15:18:21 +0000#33150 [Com]: shtool php insecure temporary file creation
  • sniper@php.netSat, 18 Jun 2005 18:57:34 +0000#33150 [Asn]: shtool: insecure temporary file creation
  • sniper@php.netSat, 18 Jun 2005 18:57:47 +0000#33150 [Asn->Csd]: shtool: insecure temporary file creation