Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.security > #4404 > unrolled thread

RE: [SECURITY] [DSA 3386-2] unzip regression update

Back to article view | Back to linux.debian.security

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  RE: [SECURITY] [DSA 3386-2] unzip regression update David McDonald <David.McDonald@semagroup.com.au> - 2015-11-10 00:00 +0100
    RE: [SECURITY] [DSA 3386-2] unzip regression update "Thijs Kinkhorst" <thijs@debian.org> - 2015-11-10 09:00 +0100
      Re: [SECURITY] [DSA 3386-2] unzip regression update Salvatore Bonaccorso <carnil@debian.org> - 2015-11-10 10:50 +0100
        RE: [SECURITY] [DSA 3386-2] unzip regression update David McDonald <David.McDonald@semagroup.com.au> - 2015-11-10 23:20 +0100
          Re: [SECURITY] [DSA 3386-2] unzip regression update Salvatore Bonaccorso <carnil@debian.org> - 2015-11-11 07:00 +0100
            RE: [SECURITY] [DSA 3386-2] unzip regression update David McDonald <David.McDonald@semagroup.com.au> - 2015-11-11 23:20 +0100

#4404 — RE: [SECURITY] [DSA 3386-2] unzip regression update

Hi Salvatore,

Your e-mail below states:

	"For the stable distribution (jessie), this problem has been fixed in version 6.0-16+deb8u2" (Note bene the last digit)

However, https://www.debian.org/security/2015/dsa-3386 states:

	"For the stable distribution (jessie), these problems have been fixed in version 6.0-16+deb8u1"

Regards,


Dave

-----Original Message-----
From: Salvatore Bonaccorso [mailto:carnil@debian.org] 
Sent: Tuesday, 10 November 2015 9:01 AM
To: debian-security-announce@lists.debian.org
Subject: [SECURITY] [DSA 3386-2] unzip regression update
Importance: High

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian Security Advisory DSA-3386-2                   security@debian.org
https://www.debian.org/security/                     Salvatore Bonaccorso
November 09, 2015                     https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : unzip
Debian Bug     : 804595

The update for unzip issued as DSA-3386-1 introduced a regression when extracting 0-byte files. Updated packages are now available to address this regression.

For the oldstable distribution (wheezy), this problem has been fixed in version 6.0-8+deb7u5.
	
For the stable distribution (jessie), this problem has been fixed in version 6.0-16+deb8u2.

For the unstable distribution (sid), this problem has been fixed in version 6.0-20.

We recommend that you upgrade your unzip packages.

Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJWQRdxAAoJEAVMuPMTQ89EzUkP/0/3Llq2nGOqaYk02mZFy5cs
DK/iRRTdEmXxkY5H4Nhhc9Zcz8Mv63pqVX/VDf2WdSgGl8otLSwbRrNirXFMpExv
vboEQhXXHW7//h4HME85FX6sEkg8m+niU0lYiXJsA3jUgWOTQUUcrmR7LWusCG/X
AUn123vIvU+wJd/EqPWSowZ3j+SgIYy19zcbvZPiHrMvLNPTt0wDu2ltq422LquL
ccq+tjaQc8wajX4ycg3JMX6dsGbBsNq0K8M71T56o4fa62bVan1xvwiowSya1T9J
OQiw3KhlMpDgda8ETq31P4GJzTyr3KSjbcgnYELWB1jLnEqXSf49YKiUoJdVZlYn
Dh8NeR9NvKlMFId7EZmYPvep9Kw0/POCD+MorWGUEyIi48Rl3YzWaFN2+9t0j+iY
8aEolm3TL/CliHq5nrFsBwq2JYldrCJG0id7EgtlWtDvnBDms1Q/hBT3cyZWdaBI
mZ/VO7MHmsZ8Ipg74hEQVT+nSMoF5YsO4uMF1ylMzYEDRPa6/eM93wUPkZdfV9/h
Ex5xIyYtnIOyC40uAsF6yis4kOlYXa4Bvdx9UQ5n1CLLquB+4XBBUvMMswepUwv4
KG6pXhfEEDzrK0agL1NRnXvMhxCBccSPv+AFakV5mJIqG7YlIzlFcwmon7H5mHd5
dFH8rj+R2ISnWUc1sGDl
=h0yH
-----END PGP SIGNATURE-----

[toc] | [next] | [standalone]

#4405

Hi David,

On Mon, November 9, 2015 23:25, David McDonald wrote:
> Hi Salvatore,
>
> Your e-mail below states:
>
> 	"For the stable distribution (jessie), this problem has been fixed in
> version 6.0-16+deb8u2" (Note bene the last digit)
>
> However, https://www.debian.org/security/2015/dsa-3386 states:
>
> 	"For the stable distribution (jessie), these problems have been fixed in
> version 6.0-16+deb8u1"

The website is updated periodically so it can take a short while before it
reflects the update that was sent out in the email.


Cheers,
Thijs

[toc] | [prev] | [next] | [standalone]

#4406

Hi David,

On Tue, Nov 10, 2015 at 08:59:04AM +0100, Thijs Kinkhorst wrote:
> Hi David,
> 
> On Mon, November 9, 2015 23:25, David McDonald wrote:
> > Hi Salvatore,
> >
> > Your e-mail below states:
> >
> > 	"For the stable distribution (jessie), this problem has been fixed in
> > version 6.0-16+deb8u2" (Note bene the last digit)
> >
> > However, https://www.debian.org/security/2015/dsa-3386 states:
> >
> > 	"For the stable distribution (jessie), these problems have been fixed in
> > version 6.0-16+deb8u1"
> 
> The website is updated periodically so it can take a short while before it
> reflects the update that was sent out in the email.

Just an additional note on the version numbers: the 6.0-16+deb8u1 was
the version which fixed the security isses with CVE. 6.0-16+deb8u2 is
an additional update which fixes a regression when extracting 0-byte
files. So what the webpage reflects is the version where the security
issues were fixed.

Hope this helps!

Regards,
Salvatore

[toc] | [prev] | [next] | [standalone]

#4411

Thank you Salvatore & Thijs for your responses.

I appreciate and understand your advice.

My specific interest in the matter arose after receiving the alert. I prepared to install the update that was listed in the e-mail and found that the latest I could obtain (using apt-get) was the earlier version. I investigated further to ensure the system was appropriately up-to-date. Fortunately the web site confirmed that the version I had obtained with apt-get addressed the particular issue identified in the alert.

It did, however leave me with some niggling doubts - as the difference might be interpreted as an indication of error or omission. (Your e-mail has, of course, dispelled such doubts).

So, though perhaps this has been considered previously, in the interests of improving Debian may I suggest that it might be better to delay the e-mail until the web page is updated (or, better yet, "push" the update of the web page)?

Irrespective, many thanks again to both of you and to the Debian community as a whole for all the work, the immense amount of work, that goes into making Debian such a wonderful distro.


Dave McDonald

-----Original Message-----
From: Salvatore Bonaccorso [mailto:salvatore.bonaccorso@gmail.com] On Behalf Of Salvatore Bonaccorso
Sent: Tuesday, 10 November 2015 8:46 PM
To: David McDonald <David.McDonald@semagroup.com.au>
Cc: 'debian-security@lists.debian.org' <debian-security@lists.debian.org>
Subject: Re: [SECURITY] [DSA 3386-2] unzip regression update

Hi David,

On Tue, Nov 10, 2015 at 08:59:04AM +0100, Thijs Kinkhorst wrote:
> Hi David,
> 
> On Mon, November 9, 2015 23:25, David McDonald wrote:
> > Hi Salvatore,
> >
> > Your e-mail below states:
> >
> > 	"For the stable distribution (jessie), this problem has been fixed 
> > in version 6.0-16+deb8u2" (Note bene the last digit)
> >
> > However, https://www.debian.org/security/2015/dsa-3386 states:
> >
> > 	"For the stable distribution (jessie), these problems have been 
> > fixed in version 6.0-16+deb8u1"
> 
> The website is updated periodically so it can take a short while 
> before it reflects the update that was sent out in the email.

Just an additional note on the version numbers: the 6.0-16+deb8u1 was the version which fixed the security isses with CVE. 6.0-16+deb8u2 is an additional update which fixes a regression when extracting 0-byte files. So what the webpage reflects is the version where the security issues were fixed.

Hope this helps!

Regards,
Salvatore

[toc] | [prev] | [next] | [standalone]

#4414

Hi Dave,

On Tue, Nov 10, 2015 at 09:54:19PM +0000, David McDonald wrote:
> Thank you Salvatore & Thijs for your responses.
> 
> I appreciate and understand your advice.
> 
> My specific interest in the matter arose after receiving the alert.
> I prepared to install the update that was listed in the e-mail and
> found that the latest I could obtain (using apt-get) was the earlier
> version. I investigated further to ensure the system was
> appropriately up-to-date. Fortunately the web site confirmed that
> the version I had obtained with apt-get addressed the particular
> issue identified in the alert.
> 
> It did, however leave me with some niggling doubts - as the
> difference might be interpreted as an indication of error or
> omission. (Your e-mail has, of course, dispelled such doubts).
> 
> So, though perhaps this has been considered previously, in the
> interests of improving Debian may I suggest that it might be better
> to delay the e-mail until the web page is updated (or, better yet,
> "push" the update of the web page)?

Updating in timely matter will probably not work with the current
infrastructure unless the specific website can be updated on demand
(instead of the regular interval triggered). But it is inportant to us
that delivered updates and debian-security-announce mail are closely
followed.

As you said above that you actually didn't recieved the update
immediately via apt-get upgrade after the mail announce: I have sent
out the advisory just after the package got installed into the
archive, but I have heard from the Debian system administrators, that
two security-mirrors were not updates and were only fixed later. So
maybe you got hit by this issue.

If you check it now, you have unzip 6.0-16+deb8u2 available via apt,
right?

Regards,
Salvatore

[toc] | [prev] | [next] | [standalone]

#4418

Hi Salvatore,

Correct - I now have the latest version:

# dpkg --list unzip
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name                        Version            Architecture       Description
+++-===========================-==================-==================-===========================================================
ii  unzip                       6.0-16+deb8u2      amd64              De-archiver for .zip files

I expect that you're also right about being caught up with the issue concerning mirrors getting updated, though I don't immediately see how I can verify if this is true or not.

Much appreciated,


Dave

-----Original Message-----
From: Salvatore Bonaccorso [mailto:salvatore.bonaccorso@gmail.com] On Behalf Of Salvatore Bonaccorso
Sent: Wednesday, 11 November 2015 4:52 PM
To: David McDonald <David.McDonald@semagroup.com.au>
Cc: 'debian-security@lists.debian.org' <debian-security@lists.debian.org>
Subject: Re: [SECURITY] [DSA 3386-2] unzip regression update

Hi Dave,

On Tue, Nov 10, 2015 at 09:54:19PM +0000, David McDonald wrote:
> Thank you Salvatore & Thijs for your responses.
> 
> I appreciate and understand your advice.
> 
> My specific interest in the matter arose after receiving the alert.
> I prepared to install the update that was listed in the e-mail and 
> found that the latest I could obtain (using apt-get) was the earlier 
> version. I investigated further to ensure the system was appropriately 
> up-to-date. Fortunately the web site confirmed that the version I had 
> obtained with apt-get addressed the particular issue identified in the 
> alert.
> 
> It did, however leave me with some niggling doubts - as the difference 
> might be interpreted as an indication of error or omission. (Your 
> e-mail has, of course, dispelled such doubts).
> 
> So, though perhaps this has been considered previously, in the 
> interests of improving Debian may I suggest that it might be better to 
> delay the e-mail until the web page is updated (or, better yet, "push" 
> the update of the web page)?

Updating in timely matter will probably not work with the current infrastructure unless the specific website can be updated on demand (instead of the regular interval triggered). But it is inportant to us that delivered updates and debian-security-announce mail are closely followed.

As you said above that you actually didn't recieved the update immediately via apt-get upgrade after the mail announce: I have sent out the advisory just after the package got installed into the archive, but I have heard from the Debian system administrators, that two security-mirrors were not updates and were only fixed later. So maybe you got hit by this issue.

If you check it now, you have unzip 6.0-16+deb8u2 available via apt, right?

Regards,
Salvatore

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.security

csiph-web