-----BEGIN PGP SIGNED MESSAGE-----

===========================================================================
             AUSCERT External Security Bulletin Redistribution

            ESB-2001.152 -- Debian Security Advisory DSA-046-1
               exuberant-ctags uses insecure temporary files
                               17 April 2001

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:                exuberant-ctags
Vendor:                 Debian
Operating System:       Debian GNU/Linux 2.2
Platform:               alpha
                        arm
                        i386
                        m68k
                        powerpc
                        sparc
Impact:                 Reduced Security

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----

- - ------------------------------------------------------------------------
Debian Security Advisory DSA-046-1                   security@debian.org
http://www.debian.org/security/                         Wichert Akkerman
April 15, 2001
- - ------------------------------------------------------------------------


Package        : exuberant-ctags
Problem type   : insecure temporary files
Debian-specific: no

Colin Phipps discovered that the exuberant-ctags packages as distributed
with Debian GNU/Linux 2.2 creates temporary files insecurely. This has
been fixed in version 1:3.2.4-0.1 of the Debian package, and upstream
version 3.5.

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.

Debian GNU/Linux 2.2 alias potato
- - ---------------------------------

  Potato was released for alpha, arm, i386, m68k, powerpc and sparc.

  Source archives:
    http://security.debian.org/dists/stable/updates/main/source/exuberant-ctags_3.2.4-0.1.diff.gz
      MD5 checksum: 39f3a5578b34ee5c92487ad666640f76
    http://security.debian.org/dists/stable/updates/main/source/exuberant-ctags_3.2.4-0.1.dsc
      MD5 checksum: 28829651dade3469b57562d07b79db57
    http://security.debian.org/dists/stable/updates/main/source/exuberant-ctags_3.2.4.orig.tar.gz
      MD5 checksum: 55a96549e98e1ae55e356a5b92e11c0b

  Alpha architecture:
    http://security.debian.org/dists/stable/updates/main/binary-alpha/exuberant-ctags_3.2.4-0.1_alpha.deb
      MD5 checksum: 5729175cd362b1db8ae12df5e698514f

  ARM architecture:
    http://security.debian.org/dists/stable/updates/main/binary-arm/exuberant-ctags_3.2.4-0.1_arm.deb
      MD5 checksum: 6cae95b120683fd54a4b91d3debcbc97

  Intel ia32 architecture:
    http://security.debian.org/dists/stable/updates/main/binary-i386/exuberant-ctags_3.2.4-0.1_i386.deb
      MD5 checksum: 34d47b29d526d34b1b74701884201400

  Motorola 680x0 architecture:
    http://security.debian.org/dists/stable/updates/main/binary-m68k/exuberant-ctags_3.2.4-0.1_m68k.deb
      MD5 checksum: 31dd7e10a5ed1cca3d43c1f6af025f5e

  PowerPC architecture:
    http://security.debian.org/dists/stable/updates/main/binary-powerpc/exuberant-ctags_3.2.4-0.1_powerpc.deb
      MD5 checksum: 992fe75ae8d2b996e39650bb1af65646

  Sun Sparc architecture:
    http://security.debian.org/dists/stable/updates/main/binary-sparc/exuberant-ctags_3.2.4-0.1_sparc.deb
      MD5 checksum: 998c4b4b261d2d21a46119992946cc05

  These files will be moved into
  ftp://ftp.debian.org/debian/dists/stable/*/binary-$arch/ soon.

For not yet released architectures please refer to the appropriate
directory ftp://ftp.debian.org/debian/dists/sid/binary-$arch/ .

- - -- 
- - ----------------------------------------------------------------------------
apt-get: deb http://security.debian.org/ stable/updates main
dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org

- -----BEGIN PGP SIGNATURE-----
Version: 2.6.3ia
Charset: noconv

iQB1AwUBOtmS3qjZR/ntlUftAQFBcwL9EW1ximWpQAFo8a/uKzd0lusCUBydMoZh
10gz/3qNETS9gAOh/LY+lurJGFEtc9Kh8QApfssnB37+lD/WP+n6el/Zge6FqaCE
tpdbmaAyVmntJujEPsUH6dksksXcwZjM
=/kXv
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content.  The decision to use any or all of this information is
the responsibility of each user or organisation, and should be done so in
accordance with site policies and procedures.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the original authors to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

	http://www.auscert.org.au/Information/advisories.html

If you believe that your system has been compromised, contact AusCERT or
your representative in FIRST (Forum of Incident Response and Security
Teams).

Internet Email: auscert@auscert.org.au
Facsimile:	(07) 3365 7031
Telephone:	(07) 3365 4417 (International: +61 7 3365 4417)
		AusCERT personnel answer during Queensland business hours
		which are GMT+10:00 (AEST).
		On call after hours for emergencies.

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv
Comment: ftp://ftp.auscert.org.au/pub/auscert/AUSCERT_PGP.key

iQCVAwUBOtxW8ih9+71yA2DNAQHsZwP/RyQRSNqEluhq6iTCzoKc8kGeYZ3OoLBn
M92a9SUciE6SgKn8xAcNtbKX26k6eipamm2FE+3eYzxl/2gC/tlArE5IVLOrme7r
m/UJGPMe/+OJFABEdlS/wiRR6/pTPhUUiS/Dwr/igtDNccHYLPmOzmEBnXgHfLqJ
zeYriUOJ0k4=
=icO5
-----END PGP SIGNATURE-----