Subject: ecl has rpath to insecure location (/tmp/buildd/ecl-0.9j-20080306/build/)
From: Bill Allombert <[email-masked]>
To: [email-masked]
Date: Wed, 20 Aug 2008 10:55:51 +0200

Package: ecl
Version: 0.9j-20080306-4
Severity: serious
Tags: security

Hello Debian Common Lisp Team,
ecl includes a ELF file /usr/lib/ecl/asdf.fas with a rpath pointing to
/tmp/buildd/ecl-0.9j-20080306/build/.

This allows an attacker with write access to that directory to
add modified libraries which will be loaded when someone
else run ecl.

Cheers,
-- 
Bill. <[email-masked]>

Imagine a large red swirl here.