Re: [Full-Disclosure] unarj dir-transversal bug (../../../..)

From: Cedric Blancher (blancher_at_cartel-securite.fr)
Date: 10/12/04

  • Next message: Jelmer: "[Full-Disclosure] Adobe acrobat / Adobe Reader 6 can read local files" 
    To: evilninja <evilninja@gmx.net>
Date: Tue, 12 Oct 2004 15:16:33 +0200

    Le mar 12/10/2004 à 13:48, evilninja a écrit :
    > > arj != unarj! debian is stubido dist nd it pakage ''arj'' as ''unarj''!
    > um, actually i had to install a package called "unarj", obviously it's
    > from the same source package. i wonder why this is the case at all. when i
    > have "gzip", i don't _install_ "ungzip" too. but this is another discussion...

    Debian stable :

    ~$ dpkg -l *arj*
    Souhait=inconnU/Installé/suppRimé/Purgé/H=à garder
    |
    État=Non/Installé/fichier-Config/dépaqUeté/échec-conFig/H=semi-installé
    |/ Err?=(aucune)/H=à garder/besoin Réinstallation/X=les deux (État,Err:
    majuscule=mauvais)
    ||/ Nom Version Description
    +++-==============-==============-============================================
    ii unarj 2.43-3 arj unarchive utility

    Debian unstable :

    ~$ dpkg -l *arj*
    Souhait=inconnU/Installé/suppRimé/Purgé/H=à garder
    |
    État=Non/Installé/fichier-Config/dépaqUeté/échec-conFig/H=semi-installé
    |/ Err?=(aucune)/H=à garder/besoin Réinstallation/X=les deux (État,Err:
    majuscule=mauvais)
    ||/ Nom Version Description
    +++-==============-==============-============================================
    ii arj 3.10.21-1 archiver for .arj files
    ii unarj 3.10.21-1 transitional dummy package

    There was a time when arj archiver was not available under Debian, for
    licensing/distribution problems, and only unarj package was available.
    As you can see, stable has only unarj 2.43 in non-free section :

            http://packages.debian.org/stable/utils/unarj

    Now, they have both arj and unarj 3.10.21, unarj being transitional for
    people to upgrade smoothly to old unarj 2 only package to full-featured
    arj 3 package when moving to upper distro. So expect unarj to disappear
    soon or later and have one arj package (probably when sarge will be
    flaged as stable).

    By the way, unarj depends on arj, arj package allows dearchiving (see
    man page) exactly as unarj does and they share the same source as you
    noticed. 

    -- 
http://www.netexit.com/~sid/
PGP KeyID: 157E98EE FingerPrint: FA62226DA9E72FA8AECAA240008B480E157E98EE
>> Hi! I'm your friendly neighbourhood signature virus.
>> Copy me to your signature file and help me spread!
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html
  • Next message: Jelmer: "[Full-Disclosure] Adobe acrobat / Adobe Reader 6 can read local files"

    Relevant Pages