diff --git a/STABLE/changelog.txt b/STABLE/changelog.txt index 84220d178..d7939c080 100644 --- a/STABLE/changelog.txt +++ b/STABLE/changelog.txt @@ -37,3 +37,7 @@ Changes since 1.4.9 17) Implement Sean Mathews's fix for Proxy ARP/IPSEC. 18) Update rfc1918. + +19) Fix local exploit vulnerability. + +20) Hack security fix so that it works under Slackware. diff --git a/STABLE/functions b/STABLE/functions index 73990d0d3..eb0e232d2 100644 --- a/STABLE/functions +++ b/STABLE/functions @@ -247,14 +247,14 @@ mktempdir() { [ -z "$MKTEMP" ] && find_mktemp case "$MKTEMP" in - BSD) - mktemp -d /tmp/shorewall.XXXXXX - ;; STD) mktemp -td shorewall.XXXXXX ;; - None) - mkdir /tmp/shorewall-$$ && echo /tmp/shorewall-$$ + None|BSD) + # + # Not all versions of the BSD mktemp support the -d option under Linux + # + mkdir /tmp/shorewall-$$ && chmod 700 /tmp/shorewall-$$ && echo /tmp/shorewall-$$ ;; *) echo " ERROR:Internal error in mktempdir" diff --git a/STABLE/releasenotes.txt b/STABLE/releasenotes.txt index a389888df..64fabfa1e 100644 --- a/STABLE/releasenotes.txt +++ b/STABLE/releasenotes.txt @@ -49,6 +49,11 @@ Problems Corrected since version 1.4.9: 13. The rfc1918 file has been updated. +14. An exploitable vulnerability that allows local non-root users to + cause arbitrary files to be overwritten has been eliminated. + +15) The security vulnerability fix failed under Slackware 9.1. + Migration Issues: None. diff --git a/STABLE2/changelog.txt b/STABLE2/changelog.txt index 6efec2b36..d7e984a78 100644 --- a/STABLE2/changelog.txt +++ b/STABLE2/changelog.txt @@ -38,3 +38,5 @@ Changes since 2.0.2 17) Fix bogus code in process_tc_rule() 18) Fix security vulnerability involving temporary files/directories. + +19) Hack security fix so that it works under Slackware. diff --git a/STABLE2/functions b/STABLE2/functions index e8aa7d942..55a971171 100755 --- a/STABLE2/functions +++ b/STABLE2/functions @@ -407,20 +407,20 @@ mktempdir() { [ -z "$MKTEMP" ] && find_mktemp case "$MKTEMP" in - BSD) - mktemp -d /tmp/shorewall.XXXXXX - ;; STD) mktemp -td shorewall.XXXXXX ;; - None) - mkdir /tmp/shorewall-$$ && echo /tmp/shorewall-$$ + None|BSD) + # + # Not all versions of the BSD mktemp support the -d option under Linux + # + mkdir /tmp/shorewall-$$ && chmod 700 /tmp/shorewall-$$ && echo /tmp/shorewall-$$ ;; *) echo " ERROR:Internal error in mktempdir" ;; esac -} +} # # Read a file and handle "INCLUDE" directives diff --git a/STABLE2/releasenotes.txt b/STABLE2/releasenotes.txt index e987cbd4b..78ff239bd 100644 --- a/STABLE2/releasenotes.txt +++ b/STABLE2/releasenotes.txt @@ -1,4 +1,4 @@ -Shorewall 2.0.3 +Shorewall 2.0.3b ---------------------------------------------------------------------- Problems Corrected since 2.0.2 @@ -52,6 +52,8 @@ Problems Corrected since 2.0.3 2) A potential security vulnerablilty in the way that Shorewall handles temporary files and directories has been corrected. +3) The security vulnerability fix failed under Slackware 9.1. + ----------------------------------------------------------------------- Issues when migrating from Shorewall 2.0.2 to Shorewall 2.0.3: