diff --git a/net-snmp-5.1-mktemp.diff b/net-snmp-5.1-mktemp.diff new file mode 100644 index 0000000..d233f71 --- /dev/null +++ b/net-snmp-5.1-mktemp.diff @@ -0,0 +1,20 @@ +--- local/fixproc ++++ local/fixproc +@@ -231,7 +231,7 @@ + { + # it must be "shell", so execute the shell script defined in database + +- local ($tmpfile) = "/tmp/fix_$$"; ++ local ($tmpfile) = `mktemp /tmp/fix.XXXXXXXX`; + + &create_sh_script ($fix{$proc}, $tmpfile); + +@@ -262,7 +262,7 @@ + # if not "exist", then it must be "shell", so execute the shell script + # defined in database + +- local ($tmpfile) = "/tmp/check_$$"; ++ local ($tmpfile) = `mktemp /tmp/check.XXXXXXXX`; + + &create_sh_script ($check{$proc}, $tmpfile); + diff --git a/net-snmp.spec b/net-snmp.spec index 52ccb68..bb8e5cb 100644 --- a/net-snmp.spec +++ b/net-snmp.spec @@ -3,7 +3,7 @@ Summary: A collection of SNMP protocol tools and libraries. Name: net-snmp Version: 5.2.1 -Release: 12 +Release: 13 License: BSDish Group: System Environment/Daemons URL: http://net-snmp.sourceforge.net/ @@ -37,6 +37,7 @@ Patch19: net-snmp-5.2.1-file_offset.patch Patch20: net-snmp-5.2.1-ethtool.patch Patch21: net-snmp-5.1.2-free_session.patch Patch22: net-snmp-5.2.1-clear_callback3.patch +Patch23: net-snmp-5.1-mktemp.diff Prereq: /sbin/chkconfig Obsoletes: ucd-snmp @@ -115,7 +116,7 @@ Install the net-snmp-perl package, if you want to use mib2c or SNMP with perl. %package libs Group: Development/Libraries -Requires: %{name} = %{version}-%{release} +#Requires: %{name} = %{version}-%{release} Summary: The NET-SNMP runtime libraries. %description libs @@ -156,6 +157,7 @@ and applications. %patch20 -p1 -b .ethtool %patch21 -p1 -b .free_session %patch22 -p1 -b .callback3 +%patch23 -b .mktemp # Do this patch with a perl hack... perl -pi -e "s|'\\\$install_libdir'|'%{_libdir}'|" ltmain.sh @@ -334,6 +336,10 @@ rm -rf ${RPM_BUILD_ROOT} %{_libdir}/*.la %changelog +* Tue May 31 2005 Radek Vokal - 5.2.1-13 +- CAN-2005-1740 net-snmp insecure temporary file usage (#158770) +- patch from suse.de + * Wed May 18 2005 Radek Vokal - 5.2.1-12 - session free fixed, agentx modules build fine (#157851) - fixed dependency for net-snmp libs (#156932)