Hi,

On Wed, Aug 07, 2024 at 04:03:17PM +0200, [email protected] wrote:
> Package: bsdextrautils
> Version: 2.40.2-5
> Severity: normal
> File: /usr/bin/write
> 
> After installing bsdextrautils via apt-get, /usr/bin/write is root:root and 
> 755,
> making any attempts at using it print the following:
> write: effective gid does not match group of /dev/pts/3
> 
> /dev/pts/3 (and similar files) is user:tty and 620.
> 
> Setting /usr/bin/write as root:tty and 2755 (as intended, I presume) fixes 
> this.

This likely won't come back and was part of the work around addressing
CVE-2024-28085.

For some context: 

util-linux (2.39.3-11) unstable; urgency=medium

  * Apply upstream patch fixing CVE-2024-28085
  * No longer install wall, write setgid tty

 -- Chris Hofstaedtler <[email protected]>  Wed, 27 Mar 2024 16:28:22 +0100

The same is done for bookworm and bullseye:

https://lists.debian.org/debian-security-announce/2024/msg00058.html

Regards,
Salvatore

Reply via email to