-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- --------------------------------------------------------------------------
Debian Security Advisory DSA 1013-1                    security@debian.org
http://www.debian.org/security/                             Martin Schulze
March 22nd, 2006                        http://www.debian.org/security/faq
- --------------------------------------------------------------------------

Package        : snmptrapfmt
Vulnerability  : insecure temporary file
Problem type   : local
Debian-specific: no
CVE ID         : CVE-2006-0050

Will Aoki discovered that snmptrapfmt, a configurable snmp trap
handler daemon for snmpd, does not prevent overwriting existing files
when writing to a temporary log file.

For the old stable distribution (woody) this problem has been fixed in
version 1.03woody1.

For the stable distribution (sarge) this problem has been fixed in
version 1.08sarge1.

For the unstable distribution (sid) this problem has been fixed in
version 1.10-1.

We recommend that you upgrade your snmptrapfmt package.


Upgrade Instructions
- --------------------

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
        will update the internal database
apt-get upgrade
        will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.


Debian GNU/Linux 3.0 alias woody
- --------------------------------

  Source archives:

    http://security.debian.org/pool/updates/main/s/snmptrapfmt/snmptrapfmt_1.03woody1.dsc
      Size/MD5 checksum:      526 70bff136cf1671dba87b7c25b76b534c
    http://security.debian.org/pool/updates/main/s/snmptrapfmt/snmptrapfmt_1.03woody1.tar.gz
      Size/MD5 checksum:    16716 ac6bcf8eccfa4f71e0ef9ea14bdd4ef2

  Alpha architecture:

    http://security.debian.org/pool/updates/main/s/snmptrapfmt/snmptrapfmt_1.03woody1_alpha.deb
      Size/MD5 checksum:    20836 85e594b0cba3135205290f6e9c9e45d8

  ARM architecture:

    http://security.debian.org/pool/updates/main/s/snmptrapfmt/snmptrapfmt_1.03woody1_arm.deb
      Size/MD5 checksum:    15972 727d82a7bf68f33f058026608636179b

  Intel IA-32 architecture:

    http://security.debian.org/pool/updates/main/s/snmptrapfmt/snmptrapfmt_1.03woody1_i386.deb
      Size/MD5 checksum:    15828 51cc452a5a4a34adf3eee8bd0f1cc931

  Intel IA-64 architecture:

    http://security.debian.org/pool/updates/main/s/snmptrapfmt/snmptrapfmt_1.03woody1_ia64.deb
      Size/MD5 checksum:    23470 d88193f743bd931056ababfe186b406d

  HP Precision architecture:

    http://security.debian.org/pool/updates/main/s/snmptrapfmt/snmptrapfmt_1.03woody1_hppa.deb
      Size/MD5 checksum:    17876 eb4bfab080f1e01f8c1c424b37e86d2e

  Motorola 680x0 architecture:

    http://security.debian.org/pool/updates/main/s/snmptrapfmt/snmptrapfmt_1.03woody1_m68k.deb
      Size/MD5 checksum:    15300 e5bc6331255c4d367b21fa33484a24df

  Big endian MIPS architecture:

    http://security.debian.org/pool/updates/main/s/snmptrapfmt/snmptrapfmt_1.03woody1_mips.deb
      Size/MD5 checksum:    17414 706c890e463e40982115577d6366b38c

  Little endian MIPS architecture:

    http://security.debian.org/pool/updates/main/s/snmptrapfmt/snmptrapfmt_1.03woody1_mipsel.deb
      Size/MD5 checksum:    17396 4b9549de0525237b7960fcc3fb7a7e34

  PowerPC architecture:

    http://security.debian.org/pool/updates/main/s/snmptrapfmt/snmptrapfmt_1.03woody1_powerpc.deb
      Size/MD5 checksum:    17012 77a60b2618a0d6402b61505542def0c9

  IBM S/390 architecture:

    http://security.debian.org/pool/updates/main/s/snmptrapfmt/snmptrapfmt_1.03woody1_s390.deb
      Size/MD5 checksum:    16396 9c432c75e9ab8999f706cf5f44a3f912

  Sun Sparc architecture:

    http://security.debian.org/pool/updates/main/s/snmptrapfmt/snmptrapfmt_1.03woody1_sparc.deb
      Size/MD5 checksum:    20106 dba3eb8c1af9cd1cf4887b9f9f5dc919


Debian GNU/Linux 3.1 alias sarge
- --------------------------------

  Source archives:

    http://security.debian.org/pool/updates/main/s/snmptrapfmt/snmptrapfmt_1.08sarge1.dsc
      Size/MD5 checksum:      516 b50422f5221e403d2050c14b7c66ce61
    http://security.debian.org/pool/updates/main/s/snmptrapfmt/snmptrapfmt_1.08sarge1.tar.gz
      Size/MD5 checksum:    18028 4272e8d4477b04fe767e81bf42100ddb

  Alpha architecture:

    http://security.debian.org/pool/updates/main/s/snmptrapfmt/snmptrapfmt_1.08sarge1_alpha.deb
      Size/MD5 checksum:    20432 d6ac3ca520d385a287668f1052309ace

  AMD64 architecture:

    http://security.debian.org/pool/updates/main/s/snmptrapfmt/snmptrapfmt_1.08sarge1_amd64.deb
      Size/MD5 checksum:    18940 b1569bc7eb07473243c3cb8d3ae39b0d

  ARM architecture:

    http://security.debian.org/pool/updates/main/s/snmptrapfmt/snmptrapfmt_1.08sarge1_arm.deb
      Size/MD5 checksum:    17314 09efd328261c381c3d5820fd8694687f

  Intel IA-32 architecture:

    http://security.debian.org/pool/updates/main/s/snmptrapfmt/snmptrapfmt_1.08sarge1_i386.deb
      Size/MD5 checksum:    17556 297688542b5ebc69a90d65eefcf91bf1

  Intel IA-64 architecture:

    http://security.debian.org/pool/updates/main/s/snmptrapfmt/snmptrapfmt_1.08sarge1_ia64.deb
      Size/MD5 checksum:    23648 c09e71375846d03fcc055661a4fa5583

  HP Precision architecture:

    http://security.debian.org/pool/updates/main/s/snmptrapfmt/snmptrapfmt_1.08sarge1_hppa.deb
      Size/MD5 checksum:    19622 43dd8b83363eabc50db98b94c8997669

  Motorola 680x0 architecture:

    http://security.debian.org/pool/updates/main/s/snmptrapfmt/snmptrapfmt_1.08sarge1_m68k.deb
      Size/MD5 checksum:    16940 538ee49ec5f773667ec7dd673685fb2b

  Big endian MIPS architecture:

    http://security.debian.org/pool/updates/main/s/snmptrapfmt/snmptrapfmt_1.08sarge1_mips.deb
      Size/MD5 checksum:    20446 cd81b32736aed88be213a8b081b0c433

  Little endian MIPS architecture:

    http://security.debian.org/pool/updates/main/s/snmptrapfmt/snmptrapfmt_1.08sarge1_mipsel.deb
      Size/MD5 checksum:    20528 c1c92e310b4d39d22b5fd322741c9375

  PowerPC architecture:

    http://security.debian.org/pool/updates/main/s/snmptrapfmt/snmptrapfmt_1.08sarge1_powerpc.deb
      Size/MD5 checksum:    18244 e5ed9744340de79cab0f5b79638f0fbb

  IBM S/390 architecture:

    http://security.debian.org/pool/updates/main/s/snmptrapfmt/snmptrapfmt_1.08sarge1_s390.deb
      Size/MD5 checksum:    18436 be9b62e95c994b756200e868339d378e

  Sun Sparc architecture:

    http://security.debian.org/pool/updates/main/s/snmptrapfmt/snmptrapfmt_1.08sarge1_sparc.deb
      Size/MD5 checksum:    17450 d99f331ac8d556f359d45211a78cddf8


  These files will probably be moved into the stable distribution on
  its next update.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.2 (GNU/Linux)

iD8DBQFEIOtTW5ql+IAeqTIRAoTjAJ9JBST8vYtEoA17BmMriapCYaqlogCdFIWb
/oFqeRbFJO2oacu/kMcy5vw=
=rCmj
-----END PGP SIGNATURE-----