full-disclosure - unarj dir-transversal bug (../../../..)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1097586993.2456.41.camel@anduril.intranet.cartel-securite.net>
From: blancher at cartel-securite.fr (Cedric Blancher)
Subject: unarj dir-transversal bug (../../../..)

Le mar 12/10/2004 ? 13:48, evilninja a ?crit :
> > arj != unarj! debian is stubido dist nd it pakage ''arj'' as ''unarj''!
> um, actually i had to install a package called "unarj", obviously it's
> from the same source package. i wonder why this is the case at all. when i
> have "gzip", i don't _install_ "ungzip" too. but this is another discussion...

Debian stable :

~$ dpkg -l *arj*
Souhait=inconnU/Install?/suppRim?/Purg?/H=? garder
|
?tat=Non/Install?/fichier-Config/d?paqUet?/?chec-conFig/H=semi-install?
|/ Err?=(aucune)/H=? garder/besoin R?installation/X=les deux (?tat,Err:
majuscule=mauvais)
||/ Nom            Version        Description
+++-==============-==============-============================================
ii  unarj          2.43-3         arj unarchive utility

Debian unstable :

~$ dpkg -l *arj*
Souhait=inconnU/Install?/suppRim?/Purg?/H=? garder
|
?tat=Non/Install?/fichier-Config/d?paqUet?/?chec-conFig/H=semi-install?
|/ Err?=(aucune)/H=? garder/besoin R?installation/X=les deux (?tat,Err:
majuscule=mauvais)
||/ Nom            Version        Description
+++-==============-==============-============================================
ii  arj            3.10.21-1      archiver for .arj files
ii  unarj          3.10.21-1      transitional dummy package

There was a time when arj archiver was not available under Debian, for
licensing/distribution problems, and only unarj package was available.
As you can see, stable has only unarj 2.43 in non-free section :

	http://packages.debian.org/stable/utils/unarj

Now, they have both arj and unarj 3.10.21, unarj being transitional for
people to upgrade smoothly to old unarj 2 only package to full-featured
arj 3 package when moving to upper distro. So expect unarj to disappear
soon or later and have one arj package (probably when sarge will be
flaged as stable).

By the way, unarj depends on arj, arj package allows dearchiving (see
man page) exactly as unarj does and they share the same source as you
noticed.


-- 
http://www.netexit.com/~sid/
PGP KeyID: 157E98EE FingerPrint: FA62226DA9E72FA8AECAA240008B480E157E98EE
>> Hi! I'm your friendly neighbourhood signature virus.
>> Copy me to your signature file and help me spread!