Full Disclosure mailing list archives
Re: unarj dir-transversal bug (../../../..)
From: Cedric Blancher <blancher () cartel-securite fr>
Date: Tue, 12 Oct 2004 15:16:33 +0200
Le mar 12/10/2004 à 13:48, evilninja a écrit :
arj != unarj! debian is stubido dist nd it pakage ''arj'' as ''unarj''!um, actually i had to install a package called "unarj", obviously it's from the same source package. i wonder why this is the case at all. when i have "gzip", i don't _install_ "ungzip" too. but this is another discussion...
Debian stable : ~$ dpkg -l *arj* Souhait=inconnU/Installé/suppRimé/Purgé/H=à garder | État=Non/Installé/fichier-Config/dépaqUeté/échec-conFig/H=semi-installé |/ Err?=(aucune)/H=à garder/besoin Réinstallation/X=les deux (État,Err: majuscule=mauvais) ||/ Nom Version Description +++-==============-==============-============================================ ii unarj 2.43-3 arj unarchive utility Debian unstable : ~$ dpkg -l *arj* Souhait=inconnU/Installé/suppRimé/Purgé/H=à garder | État=Non/Installé/fichier-Config/dépaqUeté/échec-conFig/H=semi-installé |/ Err?=(aucune)/H=à garder/besoin Réinstallation/X=les deux (État,Err: majuscule=mauvais) ||/ Nom Version Description +++-==============-==============-============================================ ii arj 3.10.21-1 archiver for .arj files ii unarj 3.10.21-1 transitional dummy package There was a time when arj archiver was not available under Debian, for licensing/distribution problems, and only unarj package was available. As you can see, stable has only unarj 2.43 in non-free section : http://packages.debian.org/stable/utils/unarj Now, they have both arj and unarj 3.10.21, unarj being transitional for people to upgrade smoothly to old unarj 2 only package to full-featured arj 3 package when moving to upper distro. So expect unarj to disappear soon or later and have one arj package (probably when sarge will be flaged as stable). By the way, unarj depends on arj, arj package allows dearchiving (see man page) exactly as unarj does and they share the same source as you noticed. -- http://www.netexit.com/~sid/ PGP KeyID: 157E98EE FingerPrint: FA62226DA9E72FA8AECAA240008B480E157E98EE
Hi! I'm your friendly neighbourhood signature virus. Copy me to your signature file and help me spread!
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- Re: unarj dir-transversal bug (../../../..), (continued)
- Re: unarj dir-transversal bug (../../../..) Chris Umphress (Oct 11)
- Re: unarj dir-transversal bug (../../../..) doubles (Oct 11)
- Re: unarj dir-transversal bug (../../../..) Chris Umphress (Oct 11)
- Re: unarj dir-transversal bug (../../../..) evilninja (Oct 11)
- Re: unarj dir-transversal bug (../../../..) Chris Umphress (Oct 11)
- Re: unarj dir-transversal bug (../../../..) evilninja (Oct 12)
- Re: unarj dir-transversal bug (../../../..) Chris Umphress (Oct 12)
- Re: unarj dir-transversal bug (../../../..) Christian Kujau (Oct 12)
- Re: unarj dir-transversal bug (../../../..) Chris Umphress (Oct 11)
- Re: unarj dir-transversal bug (../../../..) evilninja (Oct 12)
- Re: unarj dir-transversal bug (../../../..) Cedric Blancher (Oct 12)
- Re: [OT] unarj dir-transversal bug (../../../..) evilninja (Oct 12)
- Re: unarj dir-transversal bug (../../../..) Harry de Grote (Oct 12)