From cd8fa738b0ed3b5fb89ac00068fdc2e20c1b6169 Mon Sep 17 00:00:00 2001
From: Gyorgy Sarvari <skandigraun@gmail.com>
Date: Mon, 2 Feb 2026 14:03:01 +0100
Subject: [PATCH] CVE-2003-0887

The vulnerability is about exmaple config files placing cache files
into a world-writable directory (/tmp) instead of something more
secure.

This patch changes this path to /var/lib/ez-ipupdate, which is
not world-writable by default.

CVE: CVE-2003-0887
Upstream-Status: Inactive-Upstream [lastcommit: 2002]
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
---
 example-dhs.conf       | 2 +-
 example-dyndns.conf    | 2 +-
 example-dyns.conf      | 2 +-
 example-easydns.conf   | 2 +-
 example-gnudip.conf    | 2 +-
 example-heipv6tb.conf  | 2 +-
 example-justlinux.conf | 2 +-
 example-ods.conf       | 2 +-
 example-pgpow.conf     | 2 +-
 example-tzo.conf       | 2 +-
 10 files changed, 10 insertions(+), 10 deletions(-)

--- a/example-dhs.conf
+++ b/example-dhs.conf
@@ -11,7 +11,7 @@ host=mydomain.whatever.com
 interface=eth1
 
 # if you use run-as ensure the user has permission to write this file
-cache-file=/tmp/ez-ipupdate.cache
+cache-file=/var/lib/ez-ipupdate/ez-ipupdate.cache
 
 # uncomment this once you have everything working how you want and you are
 # ready to have ez-ipupdate running in the background all the time. to stop it
--- a/example-dyndns.conf
+++ b/example-dyndns.conf
@@ -19,7 +19,7 @@ max-interval=2073600
 #cache-file=/etc/ez-ipupdate.cache.eth1
 
 # for the mean time we'll just use a cache file in the temp directory
-cache-file=/tmp/ez-ipupdate.cache
+cache-file=/var/lib/ez-ipupdate/ez-ipupdate.cache
 
 # uncomment this once you have everything working how you want and you are
 # ready to have ez-ipupdate running in the background all the time. to stop it
--- a/example-dyns.conf
+++ b/example-dyns.conf
@@ -11,7 +11,7 @@ host=myhost
 #interface=eth1
 
 # if you use run-as ensure the user has permission to write this file
-#cache-file=/tmp/ez-ipupdate.cache
+#cache-file=/var/lib/ez-ipupdate/ez-ipupdate.cache
 
 # uncomment this once you have everything working how you want and you are
 # ready to have ez-ipupdate running in the background all the time. to stop it
--- a/example-easydns.conf
+++ b/example-easydns.conf
@@ -11,7 +11,7 @@ host=mydomain.whatever.com
 interface=eth1
 
 # if you use run-as ensure the user has permission to write this file
-cache-file=/tmp/ez-ipupdate.cache
+cache-file=/var/lib/ez-ipupdate/ez-ipupdate.cache
 
 # uncomment this once you have everything working how you want and you are
 # ready to have ez-ipupdate running in the background all the time. to stop it
--- a/example-gnudip.conf
+++ b/example-gnudip.conf
@@ -15,7 +15,7 @@ max-interval=2073600
 #address=0.0.0.0
 
 # if you use run-as ensure the user has permission to write this file
-cache-file=/tmp/ez-ipupdate.cache
+cache-file=/var/lib/ez-ipupdate/ez-ipupdate.cache
 
 # uncomment this once you have everything working how you want and you are
 # ready to have ez-ipupdate running in the background all the time. to stop it
--- a/example-heipv6tb.conf
+++ b/example-heipv6tb.conf
@@ -18,7 +18,7 @@ max-interval=2073600
 #cache-file=/etc/ez-ipupdate.cache.eth1
 
 # for the mean time we'll just use a cache file in the temp directory
-cache-file=/tmp/ez-ipupdate.cache
+cache-file=/var/lib/ez-ipupdate/ez-ipupdate.cache
 
 # uncomment this once you have everything working how you want and you are
 # ready to have ez-ipupdate running in the background all the time. to stop it
--- a/example-justlinux.conf
+++ b/example-justlinux.conf
@@ -11,7 +11,7 @@ host=mydomain.penguinpowered.com
 interface=eth1
 
 # if you use run-as ensure the user has permission to write this file
-cache-file=/tmp/ez-ipupdate.cache
+cache-file=/var/lib/ez-ipupdate/ez-ipupdate.cache
 
 # uncomment this once you have everything working how you want and you are
 # ready to have ez-ipupdate running in the background all the time. to stop it
--- a/example-ods.conf
+++ b/example-ods.conf
@@ -11,7 +11,7 @@ host=mydomain.ods.org
 interface=eth1
 
 # if you use run-as ensure the user has permission to write this file
-cache-file=/tmp/ez-ipupdate.cache
+cache-file=/var/lib/ez-ipupdate/ez-ipupdate.cache
 
 # uncomment this once you have everything working how you want and you are
 # ready to have ez-ipupdate running in the background all the time. to stop it
--- a/example-pgpow.conf
+++ b/example-pgpow.conf
@@ -11,7 +11,7 @@ host=mydomain.penguinpowered.com
 interface=eth1
 
 # if you use run-as ensure the user has permission to write this file
-cache-file=/tmp/ez-ipupdate.cache
+cache-file=/var/lib/ez-ipupdate/ez-ipupdate.cache
 
 # uncomment this once you have everything working how you want and you are
 # ready to have ez-ipupdate running in the background all the time. to stop it
--- a/example-tzo.conf
+++ b/example-tzo.conf
@@ -15,7 +15,7 @@ max-interval=2073600
 interface=eth1
 
 # if you use run-as ensure the user has permission to write this file
-cache-file=/tmp/ez-ipupdate.cache
+cache-file=/var/lib/ez-ipupdate/ez-ipupdate.cache
 
 # uncomment this once you have everything working how you want and you are
 # ready to have ez-ipupdate running in the background all the time. to stop it
