Debian testing security team - Advisory
DTSA-32-1
Date Reported:
February 1st, 2007
Affected Package:
bcfg2
Vulnerability:
programming error
Problem-Scope:
local
Debian-specific:
No
CVE:
None so far
More information:
Incorrect permissions for the bcfg2 configuration file could lead to password
disclosure to unprivileged users.
Please note that bcfg2 is not present in sarge.
For the testing distribution (etch) this is fixed in version 0.8.6.1-1.1etch1
For the unstable distribution (sid) this is fixed in version 0.8.7.3-1
This upgrade is recommended if you use bcfg2.
If you have the secure testing lines in your sources.list, you can update by running this command as root:
apt-get update && apt-get install bcfg2
To use the Debian testing security archive, add the following lines to your /etc/apt/sources.list:
deb http://security.debian.org/ testing/updates main contrib non-free
deb-src http://security.debian.org/ testing/updates main contrib non-free
The archive signing key can be downloaded from
http://secure-testing.debian.net/ziyi-2005-7.asc