[ Reason ]
This PU solves #1144393, related to CVE-2026-72694.
When the MRTG daemon is started as a root user and subsequently drops
privileges, a local, low-privileged attacker can exploit a symbolic link
(symlink) following vulnerability. By influencing or pre-placing a symlink in
the process ID (PID) file path, the attacker can trick the root process into
changing the ownership of an arbitrary existing file to the daemon user. This
can lead to local privilege escalation, allowing unauthorized access to or
modification of sensitive files.
[ Impact ]
If the update isn't approved, we will have a security failure that can grant
unauthorized access to sensitive files on desktops and servers.
[ Tests ]
Some manual tests were made. The changes work fine. These changes were
provided by MRTG's upstream via a patch.
[ Risks ]
The risks are very low. A small part of the source code was changed and all
changes were tested.
[ Checklist ]
[x] *all* changes are documented in the d/changelog
[x] I reviewed all changes and I approve them
[x] attach debdiff against the package in (old)stable
[x] the issue is verified as fixed in unstable
[ Changes ]
The fix creates the PID file atomically with O_CREAT|O_EXCL, rejects symlinks,
performs fchown() on the open file descriptor, and also prevents
symlink-following when writing the PID later.
[ Other info ]
No more info.