I just wrote this advisory. I'm currently waiting for the m68k porters to recompile it before releasing it. Wichert. -- ============================================================================== This combination of bytes forms a message written to you by Wichert Akkerman. E-Mail: wakkerma@cs.leidenuniv.nl WWW: http://www.wi.leidenuniv.nl/~wichert/
Subject: [SECURITY] New versions of fte fixes access problems
We have found that the fte package as supplied in our slink (frozen
and potato (unstable) archives does not drop its root priviliges
after initializing the virtual console device. This allows all users
to read and write files with root priviliges, and execute all programs
as root.
A new package (version 0.46b-4.1) has been uploaded to fix this problem.
We recommend that you upgrade your fte package immediately.
wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.
Debian GNU/Linux 2.0 alias hamm
-------------------------------
fte was not released for this (or earlier) release.
Debian GNU/Linux 2.1 alias slink (not released yet)
---------------------------------------------------
Source archives:
ftp://ftp.debian.org/debian/dists/slink/main/source/editors/fte_0.46b5-4.1.diff.gz
MD5 checksum: 44c60f6b5b55c80f7634eb405f3707e5
ftp://ftp.debian.org/debian/dists/slink/main/source/editors/fte_0.46b5-4.1.dsc
MD5 checksum: e8991ea4fe2e298b57432e80dc5fd0b8
ftp://ftp.debian.org/debian/dists/slink/main/source/editors/fte_0.46b5.orig.tar.gz
MD5 checksum: 255f2f8cd2c210b497fdcdb0b9f964ed
Intel architecture:
ftp://ftp.debian.org/debian/dists/slink/main/binary-i386/editors/fte-console_0.46b5-4.1.deb
MD5 checksum: 0d3d146749f68b11f6aed19d64161bbe
ftp://ftp.debian.org/debian/dists/slink/main/binary-i386/editors/fte_0.46b5-4.1.deb
MD5 checksum: 39a33e02915d6cc594b9170d0fc9b0f8
For not yet released architectures please refer to the appropriate
directory ftp://ftp.debian.org/debian/dists/sid/binary-$arch/ .
--
Debian GNU/Linux . Security Managers . security@debian.org
debian-security-announce@lists.debian.org
Christian Hudon . Wichert Akkerman . Martin Schulze
<chrish@debian.org> . <wakkerma@debian.org> . <joey@debian.org>
Attachment:
pgpX0OoSUcaBJ.pgp
Description: PGP signature