[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: [deb-sec] sudo package woody update


Nevermind, it looks like the problem was caused by my apt.conf file:

  APT::Default-Release "stable";
Once I change that to "woody", or just get rid of my (now unnecessary) apt.conf file, everything works fine.. Sorry for the false alarm. 

Reading Package Lists... Done
Building Dependency Tree... Done
Merging Available information
Replacing available packages info, using /var/cache/apt/available.
Information about 8989 package(s) was updated.
Reading Package Lists... Done
Building Dependency Tree... Done
2 packages upgraded, 0 newly installed, 0 to remove and 0  not upgraded.
Inst gzip (1.3.2-3woody4 Debian-Security:3.0/oldstable)
Conf gzip (1.3.2-3woody4 Debian-Security:3.0/oldstable)
Inst sudo (1.6.6-1.3woody1 Debian-Security:3.0/oldstable)
Conf sudo (1.6.6-1.3woody1 Debian-Security:3.0/oldstable)

Have a great weekend!

--Brett



On Fri, 1 Jul 2005, Brett Hamilton wrote:


Dear Debian folks,
I'm having a problem getting the recent sudo security update to install on my woody computers using the apt-get method, and I'm wondering if anybody else is experiencing the same thing, and perhaps could help figure out what is going on. Curiously, this problem only happens on 2 of the 3 computers that I have running woody. All 3 computers currently have exactly the same entries in the /etc/apt/sources.list files: 


deb http://archive.progeny.com/debian/ woody main non-free contrib
deb-src http://archive.progeny.com/debian/ woody main non-free contrib
deb http://non-us.debian.org/debian-non-US woody/non-US main contrib non-free
deb-src http://non-us.debian.org/debian-non-US woody/non-US main contrib non-free 

deb http://security.debian.org/ woody/updates main contrib non-free



Today when checking for updates:

apt-get update
dselect update
apt-get --dry-run upgrade
one computer (which I haven't updated in a few months) showed that 11 packages would get updated (including the new sudo update): 

Reading Package Lists... Done
Building Dependency Tree... Done
Merging Available information
Replacing available packages info, using /var/cache/apt/available.
Information about 8989 package(s) was updated.
Reading Package Lists... Done
Building Dependency Tree... Done
11 packages upgraded, 0 newly installed, 0 to remove and 0  not upgraded.
Inst gzip (1.3.2-3woody4 Debian-Security:3.0/oldstable)
Conf gzip (1.3.2-3woody4 Debian-Security:3.0/oldstable)
Inst libdps1 (4.1.0-16woody6 Debian:3.0r6/stable, Debian-Security:3.0/oldstable) Inst xfree86-common (4.1.0-16woody6 Debian:3.0r6/stable, Debian-Security:3.0/oldstable) Inst xlibs (4.1.0-16woody6 Debian:3.0r6/stable, Debian-Security:3.0/oldstable) Inst libxaw7 (4.1.0-16woody6 Debian:3.0r6/stable, Debian-Security:3.0/oldstable) 
Inst samba (2.2.3a-15 Debian:3.0r6/stable, Debian-Security:3.0/oldstable) []
Inst samba-common (2.2.3a-15 Debian:3.0r6/stable, Debian-Security:3.0/oldstable) 
Inst sudo (1.6.6-1.3woody1 Debian-Security:3.0/oldstable)
Inst xlibmesa3 (4.1.0-16woody6 Debian:3.0r6/stable, Debian-Security:3.0/oldstable) Inst xbase-clients (4.1.0-16woody6 Debian:3.0r6/stable, Debian-Security:3.0/oldstable) Inst xutils (4.1.0-16woody6 Debian:3.0r6/stable, Debian-Security:3.0/oldstable) Conf libdps1 (4.1.0-16woody6 Debian:3.0r6/stable, Debian-Security:3.0/oldstable) Conf xfree86-common (4.1.0-16woody6 Debian:3.0r6/stable, Debian-Security:3.0/oldstable) Conf xlibs (4.1.0-16woody6 Debian:3.0r6/stable, Debian-Security:3.0/oldstable) Conf libxaw7 (4.1.0-16woody6 Debian:3.0r6/stable, Debian-Security:3.0/oldstable) Conf samba-common (2.2.3a-15 Debian:3.0r6/stable, Debian-Security:3.0/oldstable) 
Conf samba (2.2.3a-15 Debian:3.0r6/stable, Debian-Security:3.0/oldstable)
Conf sudo (1.6.6-1.3woody1 Debian-Security:3.0/oldstable)
Conf xlibmesa3 (4.1.0-16woody6 Debian:3.0r6/stable, Debian-Security:3.0/oldstable) Conf xbase-clients (4.1.0-16woody6 Debian:3.0r6/stable, Debian-Security:3.0/oldstable) Conf xutils (4.1.0-16woody6 Debian:3.0r6/stable, Debian-Security:3.0/oldstable)
The other two computers, which I frequently update, show no packages needing any updates: 

Reading Package Lists... Done
Building Dependency Tree... Done
Merging Available information
Replacing available packages info, using /var/cache/apt/available.
Information about 8989 package(s) was updated.
Reading Package Lists... Done
Building Dependency Tree... Done
0 packages upgraded, 0 newly installed, 0 to remove and 0  not upgraded.
The problem is that all three computers have the exact same version of sudo installed: 

ii  sudo      1.6.6-1.3
ii  sudo      1.6.6-1.3
ii  sudo      1.6.6-1.3

and this sudo version needs security update: 1.6.6-1.3woody1
I have tried various things to clean out the apt and package caches and such. I've tried changing the /etc/apt/sources.list entries from "woody" to "oldstable" and running apt-get update again, but no matter what I do, I can't get this behavior to change. I'm trying to figure out what needs to get changed for these updates to start working again. I'm not ready to upgrade to sarge, and I want my woody boxes to get security updates.
curiously, running 'apt-cache show sudo' on any of these 3 computers shows BOTH versions of the sudo packages: the new one (that should be getting installed, and the old one (that is currently installed) 

% apt-cache show sudo

Package: sudo
Priority: optional
Section: admin
Installed-Size: 268
Maintainer: Bdale Garbee <bdale@gag.com>
Architecture: i386
Version: 1.6.6-1.3woody1
Depends: libc6 (>= 2.2.4-4), libpam0g (>= 0.72-1), libpam-modules
Filename: pool/updates/main/s/sudo/sudo_1.6.6-1.3woody1_i386.deb
Size: 133990
MD5sum: cbeaf7f9f666dcd118b3e6a5aff980c5
Description: Provides limited super user privileges to specific users.
Sudo is a program designed to allow a sysadmin to give limited root
privileges to users and log root activity.  The basic philosophy is to give
as few privileges as possible but still allow people to get their work done.

Package: sudo
Priority: optional
Section: admin
Installed-Size: 336
Maintainer: Bdale Garbee <bdale@gag.com>
Architecture: i386
Version: 1.6.6-1.3
Depends: libc6 (>= 2.2.4-4), libpam0g (>= 0.72-1), libpam-modules
Filename: pool/main/s/sudo/sudo_1.6.6-1.3_i386.deb
Size: 135090
MD5sum: 35bccb8d3e98c2744c3b59de7354903b
Description: Provides limited super user privileges to specific users.
Sudo is a program designed to allow a sysadmin to give limited root
privileges to users and log root activity.  The basic philosophy is to give
as few privileges as possible but still allow people to get their work done.



I have a couple questions I hope could be answered here:
1) What's causing these security updates to not show up on some computers? 2) Is this related to security issues from the sarge release? 
3) Is there anything I can do to remedy the situation on my computers?



Thanks!
--Brett



--
To UNSUBSCRIBE, email to debian-security-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
Reply to: