Debian Bug report logs - #878138
muttprint: still vulnerable to symlink attack (race condition)

version graph

Package: muttprint; Maintainer for muttprint is Rene Engelhard <[email protected]>; Source for muttprint is src:muttprint (PTS, buildd, popcon).

Reported by: Vincent Lefevre <[email protected]>

Date: Tue, 10 Oct 2017 11:21:06 UTC

Severity: important

Tags: security, upstream

Found in version muttprint/0.73-8

Full log


Message #20 received at [email protected] (full text, mbox, reply):

Received: (at 878138) by bugs.debian.org; 10 Oct 2017 12:27:26 +0000
From [email protected] Tue Oct 10 12:27:26 2017
X-Spam-Checker-Version: SpamAssassin 3.4.1-bugs.debian.org_2005_01_02
	(2015-04-28) on buxtehude.debian.org
X-Spam-Level: 
X-Spam-Status: No, score=-6.9 required=4.0 tests=BAYES_00,HAS_BUG_NUMBER,
	RCVD_IN_DNSWL_MED,RP_MATCHES_RCVD autolearn=ham autolearn_force=no
	version=3.4.1-bugs.debian.org_2005_01_02
X-Spam-Bayes: score:0.0000 Tokens: new, 5; hammy, 125; neutral, 29; spammy, 0.
	spammytokens: hammytokens:0.000-+--H*r:jmm, 0.000-+--H*RU:inutil.org,
	0.000-+--HX-SA-Exim-Scanned:inutil.org, 0.000-+--H*RU:83.151.30.8,
	0.000-+--H*r:inutil.org
Return-path: <[email protected]>
Received: from inutil.org ([83.151.30.8])
	by buxtehude.debian.org with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:256)
	(Exim 4.89)
	(envelope-from <[email protected]>)
	id 1e1td8-0004cF-5c
	for [email protected]; Tue, 10 Oct 2017 12:27:26 +0000
Received: from jmm by inutil.org with local (Exim 4.72)
	(envelope-from <[email protected]>)
	id 1e1td6-0005jm-C0; Tue, 10 Oct 2017 14:27:24 +0200
Date: Tue, 10 Oct 2017 14:27:24 +0200
From: Moritz Muehlenhoff <[email protected]>
To: Vincent Lefevre <[email protected]>
Cc: [email protected]
Subject: Re: Bug#878138: muttprint: still vulnerable to symlink attack
 (race condition)
Message-ID: <[email protected]>
References: <[email protected]>
 <[email protected]>
 <[email protected]>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <[email protected]>
User-Agent: Mutt/1.5.20 (2009-06-14)
X-SA-Exim-Connect-IP: <locally generated>
X-SA-Exim-Mail-From: [email protected]
X-SA-Exim-Scanned: No (on inutil.org); SAEximRunCond expanded to false
On Tue, Oct 10, 2017 at 02:16:28PM +0200, Vincent Lefevre wrote:
> On 2017-10-10 13:58:16 +0200, Moritz Muehlenhoff wrote:
> > This is neutralised by kernel hardening starting with stretch, see release notes:
> > https://www.debian.org/releases/jessie/amd64/release-notes/ch-whats-new.en.html#security
> 
> which is there just because of this kind of bugs.
> 
> Note also that this is still an optional feature, and not all users
> use Debian provided kernels.

It is not optional, see the release notes section I quoted. If you run a custom kernel
you need to enable it, otherwise you're on your own.

Cheers,
        Moritz



Send a report that this bug log contains spam.


Debian bug tracking system administrator <[email protected]>. Last modified: Thu May 15 18:43:17 2025; Machine Name: buxtehude

Debian Bug tracking system

Debbugs is free software and licensed under the terms of the GNU General Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

Copyright © 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson, 2005-2017 Don Armstrong, and many other contributors.