Package: backuppc Version: 3.1.0-4 Severity: important
In /usr/share/backuppc/bin/BackupPC_archiveHost, line 124 and 127, a shell command is build from configuration variables. However, this command is not correctly quoted and will break if configuration (or host...) contains blanks. Also, it will lead to severe malfunction if the configuration items ArchiveDest (or host or tarExt) would contain shell-interpreted characters like ", ; or $. -- System Information: Debian Release: 5.0 APT prefers testing APT policy: (990, 'testing'), (500, 'stable'), (1, 'experimental') Architecture: amd64 (x86_64) Kernel: Linux 2.6.26-1-amd64 (SMP w/2 CPU cores) Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/bash Versions of packages backuppc depends on: ii adduser 3.110 add and remove users and groups ii apache2-mpm-prefork [htt 2.2.9-10+lenny2 Apache HTTP Server - traditional n ii bzip2 1.0.5-1 high-quality block-sorting file co ii debconf [debconf-2.0] 1.5.24 Debian configuration management sy ii dpkg 1.14.25 Debian package management system ii libarchive-zip-perl 1.18-1 Module for manipulation of ZIP arc ii libcompress-zlib-perl 2.015-1 Perl module for creation and manip ii perl [libdigest-md5-perl 5.10.0-19 Larry Wall's Practical Extraction ii perl-suid 5.10.0-19 Runs setuid Perl scripts ii samba-common 2:3.2.5-4 Samba common files used by both th ii smbclient 2:3.2.5-4 a LanManager-like simple client fo ii tar 1.20-1 GNU version of the tar archiving u Versions of packages backuppc recommends: ii exim4 4.69-9 metapackage to ease Exim MTA (v4) ii exim4-daemon-light [mail-tra 4.69-9 lightweight Exim MTA (v4) daemon ii libfile-rsyncp-perl 0.68-1.1+b1 A perl based implementation of an ii openssh-client [ssh-client] 1:5.1p1-5 secure shell client, an rlogin/rsh ii rrdtool 1.3.1-4 Time-series data storage and displ ii rsync 3.0.5-1 fast remote file copy program (lik Versions of packages backuppc suggests: ii iceape-browser [www-br 1.1.14-1 Iceape Navigator (Internet browser ii iceweasel [www-browser 3.0.6-1 lightweight web browser based on M ii konqueror [www-browser 4:4.1.4-1~lenny+1 KDE 4's advanced file manager, web ii lynx-cur [www-browser] 2.8.7dev13-1 Text-mode WWW Browser with NLS sup ii par2 0.4-10 Parity Archive Volume Set, for che ii w3m [www-browser] 0.5.2-2+b1 WWW browsable pager with excellent -- debconf information: backuppc/restart-webserver: true * backuppc/configuration-note: * backuppc/reconfigure-webserver: apache2 -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
