Date: Sun, 9 Jan 2000 03:16:25 +0100
From: Wichert Akkerman wichert@soil.nl
To: debian-security-announce@lists.debian.org
Debian Security Advisory security@debian.org
http://www.debian.org/security/
Wichert Akkerman
January 9, 2000
Package: nvi Vulnerability type: local attack Debian-specific:
no
The version of nvi that was distributed with Debian GNU/Linux
2.1 has an error in the default /etc/init.d/nviboot script: it did
not handle filenames with embedded spaces correctly. This made it
possible to remove files in the root directory by creating entries
in /var/tmp/vi.recover.
This has been fixed in version 1.79-9.1 . We recommend you
upgrade your nvi package immediately.
If you use a customized version of nviboot please make sure your
version does not suffer from this problem. If you upgrade dpkg will
offer to replace it with the new safe version if needed.
wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.
Debian GNU/Linux 2.1 alias slink
This version of Debian was released only for Intel ia32, the
Motorola 680×0, the alpha and the Sun sparc architecture.
Source archives:
http://security.debian.org/dists/stable/updates/source/nvi_1.79-9.1.diff.gz
MD5 checksum: 95d8dbe42dc0c68f4fdcd99437b8c9b4
http://security.debian.org/dists/stable/updates/source/nvi_1.79-9.1.dsc
MD5 checksum: 40db70d26e6b68a234e4b9c394603b7e
http://security.debian.org/dists/stable/updates/source/nvi_1.79.orig.tar.gz
MD5 checksum: 0270bbfed66bacb94ddaf0e6f39bd9d1
Alpha architecture:
http://security.debian.org/dists/stable/updates/binary-alpha/nvi_1.79-9.1_alpha.deb
MD5 checksum: 16445e2a10aa48a0fda36868270ef5c2
Intel ia32 architecture:
http://security.debian.org/dists/stable/updates/binary-i386/nvi_1.79-9.1_i386.deb
MD5 checksum: aa056275853c9884c24dc6a421cde8a0
Motorola 680×0 architecture:
http://security.debian.org/dists/stable/updates/binary-m68k/nvi_1.79-9.1_m68k.deb
MD5 checksum: 8eb154cfe1c4c75dea55148ce6ca735f
Sun Sparc architecture:
http://security.debian.org/dists/stable/updates/binary-sparc/nvi_1.79-9.1_sparc.deb
MD5 checksum: 0b5019e39b9be3e00762e1526badcaaa
These files will be moved into
ftp://ftp.debian.org/debian/dists/stable/*/binary-$arch/
soon.
For not yet released architectures please refer to the
appropriate directory
ftp://ftp.debian.org/debian/dists/sid/binary-$arch/
.
– —
For apt-get: deb http://security.debian.org/
stable updates
For dpkg-ftp: ftp://security.debian.org/debian-security
dists/stable/updates
Mailing list: debian-security-announce@lists.debian.org