[Secure-testing-team] Bug#858872: eject: CVE-2017-6964: dmcrypt-get-device does not check the return values of setuid() or setgid()

[Salvatore Bonaccorso]

Source: eject
Version: 2.1.5+deb1+cvs20081104-13
Severity: grave
Tags: patch security

Hi,

the following vulnerability was published for eject.

CVE-2017-6964[0]:
| dmcrypt-get-device, as shipped in the eject package of Debian and
| Ubuntu, does not check the return value of the (1) setuid or (2) setgid
| function, which might cause dmcrypt-get-device to execute code, which
| was intended to run as an unprivileged user, as root. This affects
| eject through 2.1.5+deb1+cvs20081104-13.1 on Debian, eject before
| 2.1.5+deb1+cvs20081104-13.1ubuntu0.16.10.1 on Ubuntu 16.10, eject
| before 2.1.5+deb1+cvs20081104-13.1ubuntu0.16.04.1 on Ubuntu 16.04 LTS,
| eject before 2.1.5+deb1+cvs20081104-13.1ubuntu0.14.04.1 on Ubuntu 14.04
| LTS, and eject before 2.1.5+deb1+cvs20081104-9ubuntu0.1 on Ubuntu 12.04
| LTS.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2017-6964
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6964

I prepared an update for sid, which I will attack as debdiff here as
soon I have the bug number.

Regards,
Salvatore