Candidate: CVE-2014-4038
PublicDate: 2014-06-17 15:55:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4038
 https://bugzilla.redhat.com/show_bug.cgi?id=1109371
 https://bugzilla.novell.com/show_bug.cgi?id=882667
 http://openwall.com/lists/oss-security/2014/06/17/1
Description:
 ppc64-diag 2.6.1 allows local users to overwrite arbitrary files via a
 symlink attack related to (1) rtas_errd/diag_support.c and
 /tmp/get_dt_files, (2) scripts/ppc64_diag_mkrsrc and
 /tmp/diagSEsnap/snapH.tar.gz, or (3) lpd/test/lpd_ela_test.sh and
 /var/tmp/ras.
Ubuntu-Description:
 sbeattie> for (1) rtas_errd/diag_support.c fully fixed in 2.7.0,
   trusty does not have the second commit below, which should cause the
   mkstemp() call to fail; so is still not vulnerable.
 sbeattie> for (2) snap binary is not shipped in powerpc-utils
   on yakkety and newer, so scripts/ppc64_diag_mkrsrc won't write
   anything out.  It does not exist in trusty and earlier releases'
   powerpc-utils, either. For xenial, the snap script will abort
   as it's not supported on Ubuntu. So no possibility of writing the
   tar file out in any release; therefore not affected for this part.
 sbeattie> (3) is unfixed upstream. but is only in a test script that
   is not included in the package, so is not affected. Yakkety has
   patches applied by debian for this.
Notes:
Bugs:
 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=740179
Priority: medium
Discovered-by:
Assigned-to:
CVSS: 

Patches_ppc64-diag:
 upstream: https://sourceforge.net/p/linux-diag/ppc64-diag/ci/ee3e3311fa4efdb37de44b7459e2db7bb717efaa/
 upstream: https://sourceforge.net/p/linux-diag/ppc64-diag/ci/d9899e405d2d364de8a45475d421f65efeb728c8/
upstream_ppc64-diag: needs-triage
lucid_ppc64-diag: DNE
precise_ppc64-diag: DNE
saucy_ppc64-diag: DNE
trusty_ppc64-diag: not-affected (see above)
trusty/esm_ppc64-diag: DNE (trusty was not-affected [see above])
utopic_ppc64-diag: ignored (reached end-of-life)
vivid_ppc64-diag: ignored (reached end-of-life)
vivid/stable-phone-overlay_ppc64-diag: DNE
vivid/ubuntu-core_ppc64-diag: DNE
wily_ppc64-diag: ignored (reached end-of-life)
xenial_ppc64-diag: not-affected ( 2.7.0-0ubuntu1)
devel_ppc64-diag: not-affected (2.7.1-5)