Bug#431331: CVE-2007-2838: Allow arbitary files to be created/truncated

2007-07-01 Thread Steve Kemp
Package: gsambad Version: 0.1.5-5 Severity: grave Usertags: sourcescan *** Please type your report below this line *** Security issue: CVE-2007-2838 The gsambad package contains a binary (which may only be executed by the root user) with the following code in it:

Bug#431331: CVE-2007-2838: Allow arbitary files to be created/truncated

2007-07-01 Thread Daniel Baumann
Steve Kemp wrote: Security issue: CVE-2007-2838 The gsambad package contains a binary (which may only be executed by the root user) with the following code in it: I assume that the 0.1.4-2etch1 upload a few minutes ago was a security upload of yours, hence I'll wait until

Bug#431331: CVE-2007-2838: Allow arbitary files to be created/truncated

2007-07-01 Thread Steve Kemp
On Sun Jul 01, 2007 at 20:54:24 +0200, Daniel Baumann wrote: I assume that the 0.1.4-2etch1 upload a few minutes ago was a security upload of yours, hence I'll wait until this appears and upload then a fixed package to sid. yes that is correct. If you're happy to upload soon that would

Bug#431331: CVE-2007-2838: Allow arbitary files to be created/truncated

2007-07-01 Thread Steve Kemp
On Sun Jul 01, 2007 at 21:47:42 +0200, Daniel Baumann wrote: uploaded 0.1.6-2 with your patch and urgency=high, so you probably want to mention this version for testing/sid in the DSA. Great. no offence intended, but i'd be happy if you can next time attach the patch to the bug report

Bug#431331: CVE-2007-2838: Allow arbitary files to be created/truncated

2007-07-01 Thread Daniel Baumann
Steve Kemp wrote: yes that is correct. thanks. If you're happy to upload soon that would be great. I'll attach the patch I used. uploaded 0.1.6-2 with your patch and urgency=high, so you probably want to mention this version for testing/sid in the DSA. no offence intended, but i'd be