Re: unarj dir-transversal bug (../../../..)

[Cedric Blancher <blancher () cartel-securite fr>]

Le mar 12/10/2004 à 13:48, evilninja a écrit :
> > arj != unarj! debian is stubido dist nd it pakage ''arj'' as ''unarj''!
> um, actually i had to install a package called "unarj", obviously it's
> from the same source package. i wonder why this is the case at all. when i
> have "gzip", i don't _install_ "ungzip" too. but this is another discussion...

Debian stable :

~$ dpkg -l *arj*
Souhait=inconnU/Installé/suppRimé/Purgé/H=à garder
|
État=Non/Installé/fichier-Config/dépaqUeté/échec-conFig/H=semi-installé
|/ Err?=(aucune)/H=à garder/besoin Réinstallation/X=les deux (État,Err:
majuscule=mauvais)
||/ Nom            Version        Description
+++-==============-==============-============================================
ii  unarj          2.43-3         arj unarchive utility

Debian unstable :

~$ dpkg -l *arj*
Souhait=inconnU/Installé/suppRimé/Purgé/H=à garder
|
État=Non/Installé/fichier-Config/dépaqUeté/échec-conFig/H=semi-installé
|/ Err?=(aucune)/H=à garder/besoin Réinstallation/X=les deux (État,Err:
majuscule=mauvais)
||/ Nom            Version        Description
+++-==============-==============-============================================
ii  arj            3.10.21-1      archiver for .arj files
ii  unarj          3.10.21-1      transitional dummy package

There was a time when arj archiver was not available under Debian, for
licensing/distribution problems, and only unarj package was available.
As you can see, stable has only unarj 2.43 in non-free section :

        http://packages.debian.org/stable/utils/unarj

Now, they have both arj and unarj 3.10.21, unarj being transitional for
people to upgrade smoothly to old unarj 2 only package to full-featured
arj 3 package when moving to upper distro. So expect unarj to disappear
soon or later and have one arj package (probably when sarge will be
flaged as stable).

By the way, unarj depends on arj, arj package allows dearchiving (see
man page) exactly as unarj does and they share the same source as you
noticed.


-- 
http://www.netexit.com/~sid/
PGP KeyID: 157E98EE FingerPrint: FA62226DA9E72FA8AECAA240008B480E157E98EE
> > Hi! I'm your friendly neighbourhood signature virus.
> > Copy me to your signature file and help me spread!

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html