- CAN-2005-1740 net-snmp insecure temporary file usage (#158770)

net-snmp-5.1-mktemp.diff

@@ -0,0 +1,20 @@
+--- local/fixproc
++++ local/fixproc
+@@ -231,7 +231,7 @@
+     {
+       # it must be "shell", so execute the shell script defined in database
+ 
+-      local ($tmpfile) = "/tmp/fix_$$";
++      local ($tmpfile) = `mktemp /tmp/fix.XXXXXXXX`;
+ 
+       &create_sh_script ($fix{$proc}, $tmpfile);
+ 
+@@ -262,7 +262,7 @@
+       # if not "exist", then it must be "shell", so execute the shell script
+       # defined in database
+ 
+-      local ($tmpfile) = "/tmp/check_$$";
++      local ($tmpfile) = `mktemp /tmp/check.XXXXXXXX`;
+ 
+       &create_sh_script ($check{$proc}, $tmpfile);
+ 

net-snmp.spec

@@ -3,7 +3,7 @@
 Summary: A collection of SNMP protocol tools and libraries.
 Name: net-snmp
 Version: 5.2.1
-Release: 12
+Release: 13
 License: BSDish
 Group: System Environment/Daemons
 URL: http://net-snmp.sourceforge.net/
@@ -37,6 +37,7 @@ Patch19: net-snmp-5.2.1-file_offset.patch
 Patch20: net-snmp-5.2.1-ethtool.patch
 Patch21: net-snmp-5.1.2-free_session.patch
 Patch22: net-snmp-5.2.1-clear_callback3.patch
+Patch23: net-snmp-5.1-mktemp.diff
 
 Prereq: /sbin/chkconfig
 Obsoletes: ucd-snmp
@@ -115,7 +116,7 @@ Install the net-snmp-perl package, if you want to use mib2c or SNMP with perl.
 
 %package libs
 Group: Development/Libraries
-Requires: %{name} = %{version}-%{release}
+#Requires: %{name} = %{version}-%{release}
 Summary: The NET-SNMP runtime libraries.
 
 %description libs
@@ -156,6 +157,7 @@ and applications.
 %patch20 -p1 -b .ethtool
 %patch21 -p1 -b .free_session
 %patch22 -p1 -b .callback3
+%patch23 -b .mktemp
 
 # Do this patch with a perl hack...
 perl -pi -e "s|'\\\$install_libdir'|'%{_libdir}'|" ltmain.sh
@@ -334,6 +336,10 @@ rm -rf ${RPM_BUILD_ROOT}
 %{_libdir}/*.la
 
 %changelog
+* Tue May 31 2005 Radek Vokal <rvokal@redhat.com> - 5.2.1-13
+- CAN-2005-1740 net-snmp insecure temporary file usage (#158770)
+- patch from suse.de
+
 * Wed May 18 2005 Radek Vokal <rvokal@redhat.com> - 5.2.1-12
 - session free fixed, agentx modules build fine (#157851)
 - fixed dependency for net-snmp libs (#156932)