-----BEGIN PGP SIGNED MESSAGE-----

- ------------------------------------------------------------------------
Debian Security Advisory                             security@debian.org
http://www.debian.org/security/                         Wichert Akkerman
January  9, 2000
- ------------------------------------------------------------------------


Package: nvi
Vulnerability type: local attack
Debian-specific: no

The version of nvi that was distributed with Debian GNU/Linux 2.1 has
an error in the default /etc/init.d/nviboot script: it did not handle
filenames with embedded spaces correctly. This made it possible to remove
files in the root directory by creating entries in /var/tmp/vi.recover.

This has been fixed in version 1.79-9.1 . We recommend you upgrade your nvi
package immediately.

If you use a customized version of nviboot please make sure your version
does not suffer from this problem. If you upgrade dpkg will offer to replace
it with the new safe version if needed.

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.

Debian GNU/Linux 2.1 alias slink
- --------------------------------

  This version of Debian was released only for Intel ia32, the Motorola
  680x0, the alpha and the Sun sparc architecture.

  Source archives:
    http://security.debian.org/dists/stable/updates/source/nvi_1.79-9.1.diff.gz
      MD5 checksum: 95d8dbe42dc0c68f4fdcd99437b8c9b4
    http://security.debian.org/dists/stable/updates/source/nvi_1.79-9.1.dsc
      MD5 checksum: 40db70d26e6b68a234e4b9c394603b7e
    http://security.debian.org/dists/stable/updates/source/nvi_1.79.orig.tar.gz
      MD5 checksum: 0270bbfed66bacb94ddaf0e6f39bd9d1

  Alpha architecture:
    http://security.debian.org/dists/stable/updates/binary-alpha/nvi_1.79-9.1_alpha.deb
      MD5 checksum: 16445e2a10aa48a0fda36868270ef5c2

  Intel ia32 architecture:
    http://security.debian.org/dists/stable/updates/binary-i386/nvi_1.79-9.1_i386.deb
      MD5 checksum: aa056275853c9884c24dc6a421cde8a0

  Motorola 680x0 architecture:
    http://security.debian.org/dists/stable/updates/binary-m68k/nvi_1.79-9.1_m68k.deb
      MD5 checksum: 8eb154cfe1c4c75dea55148ce6ca735f

  Sun Sparc architecture:
    http://security.debian.org/dists/stable/updates/binary-sparc/nvi_1.79-9.1_sparc.deb
      MD5 checksum: 0b5019e39b9be3e00762e1526badcaaa


  These files will be moved into
  ftp://ftp.debian.org/debian/dists/stable/*/binary-$arch/ soon.


For not yet released architectures please refer to the appropriate
directory ftp://ftp.debian.org/debian/dists/sid/binary-$arch/ .

- -- 
- ----------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable updates
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates
Mailing list: debian-security-announce@lists.debian.org

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3ia
Charset: noconv

iQB1AwUBOHfvdKjZR/ntlUftAQEgOQL+LsYBMBHg7fQ8CMkK2PRQdSjuxI5+epav
6TNCg/eavbuhAcLXuAW4sfFBZ6fYTfNNeBCdIrlKuNF9J5/oOybvjSOc/6aALD5b
RmlV3MiIh5ikie8b4r4mSbG2mvo2Q8MB
=Tlju
-----END PGP SIGNATURE-----


--  
To UNSUBSCRIBE, email to debian-security-announce-request@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org