Stay Secure with the Latest Linux Advisories

security advisorycriticalsoftware update

Debian 2.2 DSA-090-1 Critical: Xtel Symlink Attack Details

The xtel (a X emulator for minitel) package as distributed with DebianGNU/Linux 2.2 has two possible symlink attacks.. ------------------------------------------------------------------------ Debian Security Advisory DSA-090-1 This email address is being protected from spambots. You need JavaScript enabled to view it. Debian -- Security Information Wichert Akkerman December 5, 2001 ------------------------------------------------------------------------ Package : xtel Problem type : symlink attack Debian-specific: no The xtel (a X emulator for minitel) package as distributed with Debian GNU/Linux 2.2 has two possible symlink attacks: * xteld creates a temporary file /tmp/.xtel- without checking for symlinks. * when printing a hardcope xtel would create a temporary file without protecting itself against symlink attacks. Both problems have been fixed in version 3.2.1-4.potato.1 . wget url will fetch the file for you dpkg -i file.deb will install the referenced file. Debian GNU/Linux 2.2 alias potato --------------------------------- Potato was released for alpha, arm, i386, m68k, powerpc and sparc. Source archives: MD5 checksum: 79575d2797c4b85fafba690f71ba97c4 MD5 checksum: 036a3763efa51ff74baa14705b86974a MD5 checksum: 9cec4556d70194beb25086d8e14b9b20 Alpha architecture: MD5 checksum: c288520adc2a519edb341c18d6b20572 ARM architecture: MD5 checksum: 0114570b5bd6973f329e8477e7c25078 Motorola 680x0 architecture: MD5 checksum: 46a9883023a1c897ee585b009d72ea92 Intel IA-32 architecture: MD5 checksum: 325874239da03f93d0ff9039336d1231 PowerPC architecture: MD5 checksum: 0299e89118646ef52579c1de1f56bcdd Sun Sparc architecture: MD5 checksum: 55f0f97fa3dbb4454f2933862333a84c These packages will be moved into the stable distribution on its next revision. For not yet released architectures please refer to the appropriate directory . -- ---------------------------------------------------------------------------- apt-get: deb Debian -- Security Information stable/updates main dpkg-ftp: dists/stable/updates/main Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it. . Debian Security Announcement DSA-092-2 addresses critical vulnerabilities related to buffer overflows in emacs package for Debian GNU/Linux 2.4.. Debian GNU/Linux, Symlink Issue, Xtel Security, Critical Advisory. . Severity: Critical. LinuxSecurity.com Team

Dec 05, 2001 •Critical Debian