Bug#431331: CVE-2007-2838: Allow arbitary files to be created/truncated

2007-07-01 Thread Daniel Baumann
Steve Kemp wrote: > yes that is correct. thanks. > If you're happy to upload soon that would be great. I'll attach the > patch I used. uploaded 0.1.6-2 with your patch and urgency=high, so you probably want to mention this version for testing/sid in the DSA. no offence intended, but i'd b

Bug#431331: CVE-2007-2838: Allow arbitary files to be created/truncated

2007-07-01 Thread Steve Kemp
On Sun Jul 01, 2007 at 21:47:42 +0200, Daniel Baumann wrote: > uploaded 0.1.6-2 with your patch and urgency=high, so you probably want > to mention this version for testing/sid in the DSA. Great. > no offence intended, but i'd be happy if you can next time attach the > patch to the bug report

Bug#431331: CVE-2007-2838: Allow arbitary files to be created/truncated

2007-07-01 Thread Steve Kemp
On Sun Jul 01, 2007 at 20:54:24 +0200, Daniel Baumann wrote: > I assume that the 0.1.4-2etch1 upload a few minutes ago was a security > upload of yours, hence I'll wait until this appears and upload then a > fixed package to sid. yes that is correct. If you're happy to upload soon that would

Bug#431331: CVE-2007-2838: Allow arbitary files to be created/truncated

2007-07-01 Thread Daniel Baumann
Steve Kemp wrote: > Security issue: CVE-2007-2838 > > The gsambad package contains a binary (which may only be > executed by the root user) with the following code in it: I assume that the 0.1.4-2etch1 upload a few minutes ago was a security upload of yours, hence I'll wait until

Bug#431331: CVE-2007-2838: Allow arbitary files to be created/truncated

2007-07-01 Thread Steve Kemp
Package: gsambad Version: 0.1.5-5 Severity: grave Usertags: sourcescan *** Please type your report below this line *** Security issue: CVE-2007-2838 The gsambad package contains a binary (which may only be executed by the root user) with the following code in it: if((fp=po