drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Ungeprüfte Verwendung von symbolischen Links in joe
Name: |
Ungeprüfte Verwendung von symbolischen Links in joe |
|
ID: |
DSA-003-1 |
|
Distribution: |
Debian |
|
Plattformen: |
Debian potato |
|
Datum: |
Sa, 2. Dezember 2000, 12:00 |
|
Referenzen: |
Keine Angabe |
|
Applikationen: |
Joe's own editor |
|
Originalnachricht |
-----BEGIN PGP SIGNED MESSAGE-----
------------------------------------------------------------------------ Debian Security Advisory DSA-003-1 security@debian.org http://www.debian.org/security/ Wichert Akkerman December 1, 2000 ------------------------------------------------------------------------
Package : joe Problem type : symlink attack Debian-specific: no
The security fix for joe released on November 22, 2000 had a problem: it created the DEADJOE file securily but didn't write anything to it. This has been fixed in version 2.8.15.2 .
This is the text from the previous advisory:
When joe (Joe's Own Editor) dies due to a signal instead of a normal exit it saves a list of the files it is editing to a file called `DEADJOE' in its current directory. Unfortunately this wasn't done safely which made joe vulnerable to a symlink attack.
wget url will fetch the file for you dpkg -i file.deb will install the referenced file.
Debian GNU/Linux 2.2 alias potato ---------------------------------
Potato was released for alpha, arm, i386, m68k, powerpc and sparc.
Source archives: joe_2.8-15.2.diff.gz MD5 checksum: e0e5bad921fef97ebe24b4fc6fba62d8 joe_2.8-15.2.dsc MD5 checksum: 7b17ccbe9b510fc16ccdffc6f6846d5b joe_2.8.orig.tar.gz MD5 checksum: 84c1aebfce7876b8639945da3c29f204
Alpha architecture: joe_2.8-15.2_alpha.deb MD5 checksum: ac6e60b0dee9c3543c120441853ecba8
ARM architecture: joe_2.8-15.2_arm.deb MD5 checksum: fd96b9695eb552c8646a845d325c3a75
Intel ia32 architecture: joe_2.8-15.2_i386.deb MD5 checksum: 01e7ec1c316974012d7a72fad3a18e83
Motorola 680x0 architecture: joe_2.8-15.2_m68k.deb MD5 checksum: b2a43f9fddffec934e05f21216b3c73f
PowerPC architecture: joe_2.8-15.2_powerpc.deb MD5 checksum: 9eb38138976d3acc8353e0a10631b45c
Sun Sparc architecture: joe_2.8-15.2_sparc.deb MD5 checksum: de84f472e4304cb7a217348002a38036
These files will be moved into ftp://ftp.debian.org/debian/dists/stable/*/binary-$arch/ soon.
For not yet released architectures please refer to the appropriate directory ftp://ftp.debian.org/debian/dists/sid/binary-$arch/ .
-- ---------------------------------------------------------------------------- apt-get: deb http://security.debian.org/ stable/updates main dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main Mailing list: debian-security-announce@lists.debian.org
-----BEGIN PGP SIGNATURE----- Version: 2.6.3ia Charset: noconv
iQB1AwUBOifP2qjZR/ntlUftAQGHGgL8CbhH/6kUxcHO4cyc9Gbp9i4YZmToE0Qf 8s5cm8F67vlXeC7FMF14AJNe50dNDGuQKJOcd2EF/8cED+caT9tI3k5Tc0B/z9pX 8gvAvx1XwfZfJHhXOH9Dgk4UTLPYHdYO =ixJM -----END PGP SIGNATURE-----
-- To UNSUBSCRIBE, email to debian-security-announce-request@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
|
|
|
|