Re: [SECURITY] [DSA 930-1] New smstools packages fix format string vulnerability

2006-01-09 Thread Florian Weimer
* Steve Kemp: > Testing will get the fix shortly via the package migration, How? By downgrading the smstools package? (etch and sid are at the same version.) -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Re: [SECURITY] [DSA 930-1] New smstools packages fix format string vulnerability

2006-01-09 Thread Florian Weimer
* Thijs Kinkhorst: > It's great to hear that unstable will be fixed soon, but why wasn't > there a grave bug filed against the package? If for some reason the > maintainer misses this DSA, it is lateron unknown that the version in > unstable is vulnerable and still needs to be fixed... Uhm, th

Re: [SECURITY] [DSA 930-1] New smstools packages fix format string vulnerability

2006-01-09 Thread Steve Kemp
On Mon, Jan 09, 2006 at 02:32:18PM +0100, Thijs Kinkhorst wrote: > >For the unstable distribution the package will be updated shortly. > > > It's great to hear that unstable will be fixed soon, but why wasn't > there a grave bug filed against the package? If for some reason the > maintainer mi

Re: [SECURITY] [DSA 930-1] New smstools packages fix format string vulnerability

2006-01-09 Thread Martin Zobel-Helas
Hi Thijs, On Monday, 09 Jan 2006, you wrote: > Michael Stone wrote: > >Vulnerability : format string attack > >Problem-Type : local > >Debian-specific: no > >CVE ID : CVE-2006-0083 > > > >Ulf Harnhammar from the Debian Security Audit project discovered a > >format string attack in the l

Re: [SECURITY] [DSA 930-1] New smstools packages fix format string vulnerability

2006-01-09 Thread Thijs Kinkhorst
Michael Stone wrote: Vulnerability : format string attack Problem-Type : local Debian-specific: no CVE ID : CVE-2006-0083 Ulf Harnhammar from the Debian Security Audit project discovered a format string attack in the logging code of smstools, which may be exploited to execute arbitary