Debian Security Advisory

DSA-003-1 joe -- symlink attack

Date Reported:

01 Dec 2000

Affected Packages:

joe

Vulnerable:

Yes

Security database references:

In Mitre's CVE dictionary: CVE-2000-1178.

More information:

The security fix for joe released on November 22, 2000 had a problem: it created the DEADJOE file securely but didn't write anything to it. This has been fixed in version 2.8-15.2.

This is the text from the previous advisory:

When joe (Joe's Own Editor) dies due to a signal instead of a normal exit it saves a list of the files it is editing to a file called `DEADJOE' in its current directory. Unfortunately this wasn't done safely which made joe vulnerable to a symlink attack.

Fixed in:

Debian 2.2 (potato)

Source:: http://security.debian.org/dists/stable/updates/main/source/joe_2.8-15.2.diff.gz; http://security.debian.org/dists/stable/updates/main/source/joe_2.8-15.2.dsc; http://security.debian.org/dists/stable/updates/main/source/joe_2.8.orig.tar.gz
alpha:: http://security.debian.org/dists/stable/updates/main/binary-alpha/joe_2.8-15.2_alpha.deb
arm:: http://security.debian.org/dists/stable/updates/main/binary-arm/joe_2.8-15.2_arm.deb
i386:: http://security.debian.org/dists/stable/updates/main/binary-i386/joe_2.8-15.2_i386.deb
m68k:: http://security.debian.org/dists/stable/updates/main/binary-m68k/joe_2.8-15.2_m68k.deb
powerpc:: http://security.debian.org/dists/stable/updates/main/binary-powerpc/joe_2.8-15.2_powerpc.deb
sparc:: http://security.debian.org/dists/stable/updates/main/binary-sparc/joe_2.8-15.2_sparc.deb