Home Security

Debian Security Advisory: New version of nvi released

By

January 10, 2000

Date: Sun, 9 Jan 2000 03:16:25 +0100
From: Wichert Akkerman [email protected]
To: [email protected]rg

Debian Security Advisory [email protected]
http://www.debian.org/security/
Wichert Akkerman
January 9, 2000

Package: nvi Vulnerability type: local attack Debian-specific:
no

The version of nvi that was distributed with Debian GNU/Linux
2.1 has an error in the default /etc/init.d/nviboot script: it did
not handle filenames with embedded spaces correctly. This made it
possible to remove files in the root directory by creating entries
in /var/tmp/vi.recover.

This has been fixed in version 1.79-9.1 . We recommend you
upgrade your nvi package immediately.

If you use a customized version of nviboot please make sure your
version does not suffer from this problem. If you upgrade dpkg will
offer to replace it with the new safe version if needed.

wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.

Debian GNU/Linux 2.1 alias slink

This version of Debian was released only for Intel ia32, the
Motorola 680×0, the alpha and the Sun sparc architecture.

Source archives:

http://security.debian.org/dists/stable/updates/source/nvi_1.79-9.1.diff.gz

MD5 checksum: 95d8dbe42dc0c68f4fdcd99437b8c9b4

http://security.debian.org/dists/stable/updates/source/nvi_1.79-9.1.dsc

MD5 checksum: 40db70d26e6b68a234e4b9c394603b7e

http://security.debian.org/dists/stable/updates/source/nvi_1.79.orig.tar.gz

MD5 checksum: 0270bbfed66bacb94ddaf0e6f39bd9d1

Alpha architecture:

http://security.debian.org/dists/stable/updates/binary-alpha/nvi_1.79-9.1_alpha.deb

MD5 checksum: 16445e2a10aa48a0fda36868270ef5c2

Intel ia32 architecture:

http://security.debian.org/dists/stable/updates/binary-i386/nvi_1.79-9.1_i386.deb

MD5 checksum: aa056275853c9884c24dc6a421cde8a0

Motorola 680×0 architecture:

http://security.debian.org/dists/stable/updates/binary-m68k/nvi_1.79-9.1_m68k.deb