Re: bug in tar 1.14-2.1

2 msg	pam.d common-passwd: obscure option includes 's...
1 msg	Re[5]: Gravitation is not responsible for peopl...
4 msg	sendmail vulnerability
4 msg	'obscure' in /etc/pam.d/common-password what do...
1 msg	[SECURITY] [DSA 1012-1] New unzip packages fix ...
1 msg	RE: [SECURITY] [DSA 1010-1] New ilohamail packa...
1 msg	dear friend

Re: bug in tar 1.14-2.1
\ mollo (19 Mar 2006)
. \ Martin Zobel-Helas (24 Mar 2006)
. . \ Bdale Garbee (24 Mar 2006)
. . \ Julien Danjou (24 Mar 2006)
. . . \ Goswin von Brederlow (24 Mar 2006)
. . . \ Bdale Garbee (25 Mar 2006)
. . \ Andreas Barth (27 Mar 2006)
. . . \ Martin Zobel-Helas (27 Mar 2006)
. . . . \ Goswin von Brederlow (28 Mar 2006)
. . . . . \ Bdale Garbee (31 Mar 2006)

1 msg	Re: [SECURITY] [DSA 1007-1] New drupal packages...
2 msg	DSA 992-1 affecting other packages?
2 msg	[MailServer Notification]Attachment Blocking No...
3 msg	No suitable pubkey ?
2 msg	Serious bug in security update for Crypt::CBC
1 msg	Re: [SECURITY] [DSA 993-2] New GnuPG packages f...
2 msg	Re: Thank you for contacting Mcafee Technical S...
1 msg	RE: [SECURITY] [DSA 996-1] New Crypt::CBC packa...
1 msg	Apache + samba problem
4 msg	umn.edu security.d.o host unreachable
36 msg	howto block ssh brute-force
2 msg	Re: [SECURITY] [DSA 993-1] New GnuPG packages f...

Subject:	Re: bug in tar 1.14-2.1
Group:	Debian-security
From:	mollo
Date:	19 Mar 2006

On Tue, 7 Mar 2006 15:19:58 +0100
Moritz Muehlenhoff <jmm> wrote:

>
> For the stable distribution (sarge) this problem has been fixed in
> version 1.14-2.1.
>

This upgrade dont allow tar -f user@host:file syntax to be used.

ie. tar -cvf myhost:/dev/st0 /home

I've some sarge (i386) running here and using the previous binary (1.14-2)
all works.

fw:/home/mathieu# ls -l /bin/tar*
-rwxr-xr-x 1 root root 163852 Feb 24 22:21 /bin/tar (1.14-2.1)
-rwxr-xr-x 1 root root 163820 Mar 19 10:51 /bin/tar.ori (1.14-2)

fw:/home/mathieu# md5sum /bin/tar*
d0ed2a62e6459375513d211a2bc5e9fb /bin/tar
96a1dd64ee6424a6cfa7839015d98d67 /bin/tar.ori

using tar 1.14-2.1

fw:/home/mathieu# tar --rmt-command=/usr/sbin/rmt -cvf
'mathieu' /etc tar:
mathieu: Cannot open: Input/output
error tar: Error is not recoverable: exiting now

using old tar 1.14-2 :

fw:/home/mathieu# tar.ori --rmt-command=/usr/sbin/rmt -cvf
'mathieu' /etc/ssh Password:
tar.ori: Removing leading `/' from member names
/etc/ssh/
/etc/ssh/moduli
/etc/ssh/ssh_host_rsa_key
/etc/ssh/ssh_config
/etc/ssh/ssh_host_rsa_key.pub
/etc/ssh/ssh_host_dsa_key
/etc/ssh/ssh_host_dsa_key.pub
/etc/ssh/sshd_config
/etc/ssh/sshd_config.dpkg-old

Also tested on 3 other sarge hosts, the 1.14-2.1 fail and all works again
if I use the previous 1.14-2 from /var/cache/apt/archives

Regards

--

-.
\ .-. _ mollo www.bghflt.org mathieu chappuis
---\-----/---\---/-`------------ -.- -... .---- -.. -.. -. -----------*
\ / `-' Bill Gates Heavy Fucking Lab Team Official Member
`-' 1AAB 26C6 1108 B93F D87F E091 B820 38FB E16D 40B8

--
To UNSUBSCRIBE, email to debian-security-REQUEST
with a subject of "unsubscribe". Trouble? Contact listmaster