maas-import-pxe-files sources path-relative config

Bug #1158425 reported by dann frazier
14
This bug affects 2 people
Affects Status Importance Assigned to Milestone
MAAS
Fix Released
Critical
Julian Edwards
1.2
Fix Released
Critical
Julian Edwards
1.3
Fix Released
Critical
Julian Edwards

Bug Description

From /usr/sbin/maas-import-pxe-files:

# Load settings if available.
settings="/etc/maas/import_pxe_files"
[ -r $settings ] && . $settings
local_settings="$(pwd)/$settings"
[ -r $local_settings ] && . $local_settings

Consider what would happen if the admin runs this from /tmp and an unprivileged user has created their own /tmp/etc/maas/import_pxe_files file.

Changed in maas:
status: New → Triaged
importance: Undecided → Critical
Revision history for this message
Marc Deslauriers (mdeslaur) wrote :

This is CVE-2013-1057

information type: Private Security → Public
Changed in maas:
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.