mirror of
https://github.com/openembedded/meta-openembedded.git
synced 2026-07-17 04:37:19 +00:00
Gyorgy Sarvari
eb8e89e3b4
Details: https://nvd.nist.gov/vuln/detail/CVE-2003-0887
The vulnerability is about the default (example) configurations,
which place cache files into the /tmp folder, that is world-writeable.
The recommendation would be to place them to a more secure folder.
The recipe however does not install these example configurations,
and as such it is not vulnerable either.
Just to make sure, patch these folders to a non-tmp folder
(and also install that folder, empty).
Some more discussion about the vulnerability:
https://bugzilla.suse.com/show_bug.cgi?id=48161
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit 0080dd7973)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
159 lines
5.9 KiB
Diff
159 lines
5.9 KiB
Diff
From cd8fa738b0ed3b5fb89ac00068fdc2e20c1b6169 Mon Sep 17 00:00:00 2001
|
|
From: Gyorgy Sarvari <skandigraun@gmail.com>
|
|
Date: Mon, 2 Feb 2026 14:03:01 +0100
|
|
Subject: [PATCH] CVE-2003-0887
|
|
|
|
The vulnerability is about exmaple config files placing cache files
|
|
into a world-writable directory (/tmp) instead of something more
|
|
secure.
|
|
|
|
This patch changes this path to /var/lib/ez-ipupdate, which is
|
|
not world-writable by default.
|
|
|
|
CVE: CVE-2003-0887
|
|
Upstream-Status: Inactive-Upstream [lastcommit: 2002]
|
|
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
|
|
---
|
|
example-dhs.conf | 2 +-
|
|
example-dyndns.conf | 2 +-
|
|
example-dyns.conf | 2 +-
|
|
example-easydns.conf | 2 +-
|
|
example-gnudip.conf | 2 +-
|
|
example-heipv6tb.conf | 2 +-
|
|
example-justlinux.conf | 2 +-
|
|
example-ods.conf | 2 +-
|
|
example-pgpow.conf | 2 +-
|
|
example-tzo.conf | 2 +-
|
|
10 files changed, 10 insertions(+), 10 deletions(-)
|
|
|
|
diff --git a/example-dhs.conf b/example-dhs.conf
|
|
index 3fe9a04..f976ae5 100755
|
|
--- a/example-dhs.conf
|
|
+++ b/example-dhs.conf
|
|
@@ -11,7 +11,7 @@ host=mydomain.whatever.com
|
|
interface=eth1
|
|
|
|
# if you use run-as ensure the user has permission to write this file
|
|
-cache-file=/tmp/ez-ipupdate.cache
|
|
+cache-file=/var/lib/ez-ipupdate/ez-ipupdate.cache
|
|
|
|
# uncomment this once you have everything working how you want and you are
|
|
# ready to have ez-ipupdate running in the background all the time. to stop it
|
|
diff --git a/example-dyndns.conf b/example-dyndns.conf
|
|
index f539dec..84b4807 100755
|
|
--- a/example-dyndns.conf
|
|
+++ b/example-dyndns.conf
|
|
@@ -19,7 +19,7 @@ max-interval=2073600
|
|
#cache-file=/etc/ez-ipupdate.cache.eth1
|
|
|
|
# for the mean time we'll just use a cache file in the temp directory
|
|
-cache-file=/tmp/ez-ipupdate.cache
|
|
+cache-file=/var/lib/ez-ipupdate/ez-ipupdate.cache
|
|
|
|
# uncomment this once you have everything working how you want and you are
|
|
# ready to have ez-ipupdate running in the background all the time. to stop it
|
|
diff --git a/example-dyns.conf b/example-dyns.conf
|
|
index 868768d..856a4d7 100644
|
|
--- a/example-dyns.conf
|
|
+++ b/example-dyns.conf
|
|
@@ -11,7 +11,7 @@ host=myhost
|
|
#interface=eth1
|
|
|
|
# if you use run-as ensure the user has permission to write this file
|
|
-#cache-file=/tmp/ez-ipupdate.cache
|
|
+#cache-file=/var/lib/ez-ipupdate/ez-ipupdate.cache
|
|
|
|
# uncomment this once you have everything working how you want and you are
|
|
# ready to have ez-ipupdate running in the background all the time. to stop it
|
|
diff --git a/example-easydns.conf b/example-easydns.conf
|
|
index 0ff20da..15d9b78 100755
|
|
--- a/example-easydns.conf
|
|
+++ b/example-easydns.conf
|
|
@@ -11,7 +11,7 @@ host=mydomain.whatever.com
|
|
interface=eth1
|
|
|
|
# if you use run-as ensure the user has permission to write this file
|
|
-cache-file=/tmp/ez-ipupdate.cache
|
|
+cache-file=/var/lib/ez-ipupdate/ez-ipupdate.cache
|
|
|
|
# uncomment this once you have everything working how you want and you are
|
|
# ready to have ez-ipupdate running in the background all the time. to stop it
|
|
diff --git a/example-gnudip.conf b/example-gnudip.conf
|
|
index 3b2fb63..d09df1f 100755
|
|
--- a/example-gnudip.conf
|
|
+++ b/example-gnudip.conf
|
|
@@ -15,7 +15,7 @@ max-interval=2073600
|
|
#address=0.0.0.0
|
|
|
|
# if you use run-as ensure the user has permission to write this file
|
|
-cache-file=/tmp/ez-ipupdate.cache
|
|
+cache-file=/var/lib/ez-ipupdate/ez-ipupdate.cache
|
|
|
|
# uncomment this once you have everything working how you want and you are
|
|
# ready to have ez-ipupdate running in the background all the time. to stop it
|
|
diff --git a/example-heipv6tb.conf b/example-heipv6tb.conf
|
|
index e31aa9c..3ebc822 100644
|
|
--- a/example-heipv6tb.conf
|
|
+++ b/example-heipv6tb.conf
|
|
@@ -18,7 +18,7 @@ max-interval=2073600
|
|
#cache-file=/etc/ez-ipupdate.cache.eth1
|
|
|
|
# for the mean time we'll just use a cache file in the temp directory
|
|
-cache-file=/tmp/ez-ipupdate.cache
|
|
+cache-file=/var/lib/ez-ipupdate/ez-ipupdate.cache
|
|
|
|
# uncomment this once you have everything working how you want and you are
|
|
# ready to have ez-ipupdate running in the background all the time. to stop it
|
|
diff --git a/example-justlinux.conf b/example-justlinux.conf
|
|
index 0afeb2c..28b3327 100755
|
|
--- a/example-justlinux.conf
|
|
+++ b/example-justlinux.conf
|
|
@@ -11,7 +11,7 @@ host=mydomain.penguinpowered.com
|
|
interface=eth1
|
|
|
|
# if you use run-as ensure the user has permission to write this file
|
|
-cache-file=/tmp/ez-ipupdate.cache
|
|
+cache-file=/var/lib/ez-ipupdate/ez-ipupdate.cache
|
|
|
|
# uncomment this once you have everything working how you want and you are
|
|
# ready to have ez-ipupdate running in the background all the time. to stop it
|
|
diff --git a/example-ods.conf b/example-ods.conf
|
|
index d0ff889..7b16f2c 100755
|
|
--- a/example-ods.conf
|
|
+++ b/example-ods.conf
|
|
@@ -11,7 +11,7 @@ host=mydomain.ods.org
|
|
interface=eth1
|
|
|
|
# if you use run-as ensure the user has permission to write this file
|
|
-cache-file=/tmp/ez-ipupdate.cache
|
|
+cache-file=/var/lib/ez-ipupdate/ez-ipupdate.cache
|
|
|
|
# uncomment this once you have everything working how you want and you are
|
|
# ready to have ez-ipupdate running in the background all the time. to stop it
|
|
diff --git a/example-pgpow.conf b/example-pgpow.conf
|
|
index 29a92d6..81e351b 100755
|
|
--- a/example-pgpow.conf
|
|
+++ b/example-pgpow.conf
|
|
@@ -11,7 +11,7 @@ host=mydomain.penguinpowered.com
|
|
interface=eth1
|
|
|
|
# if you use run-as ensure the user has permission to write this file
|
|
-cache-file=/tmp/ez-ipupdate.cache
|
|
+cache-file=/var/lib/ez-ipupdate/ez-ipupdate.cache
|
|
|
|
# uncomment this once you have everything working how you want and you are
|
|
# ready to have ez-ipupdate running in the background all the time. to stop it
|
|
diff --git a/example-tzo.conf b/example-tzo.conf
|
|
index 2a71db3..10b8dc4 100755
|
|
--- a/example-tzo.conf
|
|
+++ b/example-tzo.conf
|
|
@@ -15,7 +15,7 @@ max-interval=2073600
|
|
interface=eth1
|
|
|
|
# if you use run-as ensure the user has permission to write this file
|
|
-cache-file=/tmp/ez-ipupdate.cache
|
|
+cache-file=/var/lib/ez-ipupdate/ez-ipupdate.cache
|
|
|
|
# uncomment this once you have everything working how you want and you are
|
|
# ready to have ez-ipupdate running in the background all the time. to stop it
|