![[LWN Logo]](/images/lwn.banner.gif)
Date: Sun, 9 Jan 2000 03:16:25 +0100
From: Wichert Akkerman <wichert@soil.nl>
To: debian-security-announce@lists.debian.org
Subject: [SECURITY] New version of nvi released
-----BEGIN PGP SIGNED MESSAGE-----
- ------------------------------------------------------------------------
Debian Security Advisory security@debian.org
http://www.debian.org/security/ Wichert Akkerman
January 9, 2000
- ------------------------------------------------------------------------
Package: nvi
Vulnerability type: local attack
Debian-specific: no
The version of nvi that was distributed with Debian GNU/Linux 2.1 has
an error in the default /etc/init.d/nviboot script: it did not handle
filenames with embedded spaces correctly. This made it possible to remove
files in the root directory by creating entries in /var/tmp/vi.recover.
This has been fixed in version 1.79-9.1 . We recommend you upgrade your nvi
package immediately.
If you use a customized version of nviboot please make sure your version
does not suffer from this problem. If you upgrade dpkg will offer to replace
it with the new safe version if needed.
wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.
Debian GNU/Linux 2.1 alias slink
- --------------------------------
This version of Debian was released only for Intel ia32, the Motorola
680x0, the alpha and the Sun sparc architecture.
Source archives:
http://security.debian.org/dists/stable/updates/source/nvi_1.79-9.1.diff.gz
MD5 checksum: 95d8dbe42dc0c68f4fdcd99437b8c9b4
http://security.debian.org/dists/stable/updates/source/nvi_1.79-9.1.dsc
MD5 checksum: 40db70d26e6b68a234e4b9c394603b7e
http://security.debian.org/dists/stable/updates/source/nvi_1.79.orig.tar.gz
MD5 checksum: 0270bbfed66bacb94ddaf0e6f39bd9d1
Alpha architecture:
http://security.debian.org/dists/stable/updates/binary-alpha/nvi_1.79-9.1_alpha.deb
MD5 checksum: 16445e2a10aa48a0fda36868270ef5c2
Intel ia32 architecture:
http://security.debian.org/dists/stable/updates/binary-i386/nvi_1.79-9.1_i386.deb
MD5 checksum: aa056275853c9884c24dc6a421cde8a0
Motorola 680x0 architecture:
http://security.debian.org/dists/stable/updates/binary-m68k/nvi_1.79-9.1_m68k.deb
MD5 checksum: 8eb154cfe1c4c75dea55148ce6ca735f
Sun Sparc architecture:
http://security.debian.org/dists/stable/updates/binary-sparc/nvi_1.79-9.1_sparc.deb
MD5 checksum: 0b5019e39b9be3e00762e1526badcaaa
These files will be moved into
ftp://ftp.debian.org/debian/dists/stable/*/binary-$arch/ soon.
For not yet released architectures please refer to the appropriate
directory ftp://ftp.debian.org/debian/dists/sid/binary-$arch/ .
- --
- ----------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable updates
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates
Mailing list: debian-security-announce@lists.debian.org
-----BEGIN PGP SIGNATURE-----
Version: 2.6.3ia
Charset: noconv
iQB1AwUBOHfvdKjZR/ntlUftAQEgOQL+LsYBMBHg7fQ8CMkK2PRQdSjuxI5+epav
6TNCg/eavbuhAcLXuAW4sfFBZ6fYTfNNeBCdIrlKuNF9J5/oOybvjSOc/6aALD5b
RmlV3MiIh5ikie8b4r4mSbG2mvo2Q8MB
=Tlju
-----END PGP SIGNATURE-----
--
To UNSUBSCRIBE, email to debian-security-announce-request@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org