Your message dated Thu, 22 Nov 2012 15:18:36 +0000
with message-id <[email protected]>
and subject line Bug#693462: fixed in vim 2:7.3.547-6
has caused the Debian Bug report #693462,
regarding vim-tiny: vim.tiny tampers with acls and permissions edited file
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
693462: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=693462
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: vim-tiny
Version: 2:7.3.547-5
Severity: normal
The act of editing a file with vim.tiny appears to wipe out any ACL
set on the file, and potentially to modify the group or other
permissions:
0 dkg@pip:~$ getfacl test.txt
# file: test.txt
# owner: dkg
# group: dkg
user::rw-
user:wt215:r--
group::---
mask::r--
other::---
0 dkg@pip:~$ vim.tiny test.txt ### make a small edit, then :wq
0 dkg@pip:~$ getfacl test.txt
# file: test.txt
# owner: dkg
# group: dkg
user::rw-
group::r--
other::---
0 dkg@pip:~$
This lead to an information disclosure vulnerability. It's also
pretty annoying for a user who has tried to use ACLs to grant
permissions to a file and had them stripped away silently.
fwiw, emacs seems to do the same thing (see
http://bugs.debian.org/693461).
--dkg
-- Package-specific info:
--- real paths of main Vim binaries ---
/usr/bin/vi is /usr/bin/vim.tiny
/usr/bin/vim is /usr/bin/vim.tiny
-- System Information:
Debian Release: wheezy/sid
APT prefers testing
APT policy: (500, 'testing'), (200, 'unstable'), (1, 'experimental')
Architecture: i386 (i686)
Foreign Architectures: powerpc
Kernel: Linux 3.2.0-4-686-pae (SMP w/1 CPU core)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/bash
Versions of packages vim-tiny depends on:
ii libc6 2.13-35
ii libselinux1 2.1.9-5
ii libtinfo5 5.9-10
ii vim-common 2:7.3.547-5
vim-tiny recommends no packages.
Versions of packages vim-tiny suggests:
pn indent <none>
-- no debconf information
--- End Message ---
--- Begin Message ---
Source: vim
Source-Version: 2:7.3.547-6
We believe that the bug you reported is fixed in the latest version of
vim, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
James McCoy <[email protected]> (supplier of updated vim package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.8
Date: Thu, 22 Nov 2012 09:37:52 -0500
Source: vim
Binary: vim-common vim-gui-common vim-runtime vim-doc vim-tiny vim vim-dbg
vim-gtk vim-nox vim-athena vim-lesstif vim-gnome
Architecture: source all amd64
Version: 2:7.3.547-6
Distribution: unstable
Urgency: low
Maintainer: Debian Vim Maintainers <[email protected]>
Changed-By: James McCoy <[email protected]>
Description:
vim - Vi IMproved - enhanced vi editor
vim-athena - Vi IMproved - enhanced vi editor - with Athena GUI
vim-common - Vi IMproved - Common files
vim-dbg - Vi IMproved - enhanced vi editor (debugging symbols)
vim-doc - Vi IMproved - HTML documentation
vim-gnome - Vi IMproved - enhanced vi editor - with GNOME2 GUI
vim-gtk - Vi IMproved - enhanced vi editor - with GTK2 GUI
vim-gui-common - Vi IMproved - Common GUI files
vim-lesstif - Vi IMproved - enhanced vi editor (transitional package)
vim-nox - Vi IMproved - enhanced vi editor
vim-runtime - Vi IMproved - Runtime files
vim-tiny - Vi IMproved - enhanced vi editor - compact version
Closes: 693462
Changes:
vim (2:7.3.547-6) unstable; urgency=low
.
* Always enable ACL support. (Closes: #693462)
Checksums-Sha1:
9733425db3fe7764fed0f6c615a8505a25ac952e 1992 vim_7.3.547-6.dsc
a1474972840aa0e4e7732a257b606d8cc7a24ae6 190402 vim_7.3.547-6.debian.tar.gz
4cfa0fdacbd4ffe7baeb3b748227261d9c8183ff 142894
vim-gui-common_7.3.547-6_all.deb
81c36097ff39ba03e889a7484ad16b7c3ea2f18e 4606290 vim-runtime_7.3.547-6_all.deb
ed5e98d1e9b8dfc5bada2e1e33543475e946b055 1658792 vim-doc_7.3.547-6_all.deb
6ff4e2712d487fd538f13f62e86e719a3f8905a3 87084 vim-lesstif_7.3.547-6_all.deb
083466b57c11a15abc90fb350282ff88ab468a96 354684 vim-tiny_7.3.547-6_amd64.deb
ab98dccb11d58739797841f4a2c0fd3a33d15a62 1035050 vim-gtk_7.3.547-6_amd64.deb
d66b5affe637fef94b8197171fd6ee476354a342 1036932 vim-gnome_7.3.547-6_amd64.deb
bebed2421efda019aee4564ab312cde5cc946794 1024716 vim-athena_7.3.547-6_amd64.deb
d77b9e5323b79c887322de207e1d4e9f31fcb874 924704 vim-nox_7.3.547-6_amd64.deb
9c8674da428961e02df9c24d502f65573d38067b 162572 vim-common_7.3.547-6_amd64.deb
dd5e03f81590721d1c4046aa53341e7a97bb1433 841324 vim_7.3.547-6_amd64.deb
16daa776e254855ded6149c31313577c092bf841 7778446 vim-dbg_7.3.547-6_amd64.deb
Checksums-Sha256:
b96aad960995d1dc430e1e956999c7281097c7bd290a4bdb551cb8408f6f7c41 1992
vim_7.3.547-6.dsc
f5d569498c6616fd978bef1060e910a198ba58871740c1188a163aacc89582f8 190402
vim_7.3.547-6.debian.tar.gz
dbe9863cf07bbe92f4dda429f3c1ada1d8137d96e96b63b0285ef37f9a303349 142894
vim-gui-common_7.3.547-6_all.deb
b1e88189becce8775aee61165366ffa8491fe511f1da8675a78c07f8f9533eaf 4606290
vim-runtime_7.3.547-6_all.deb
f674934573bad5468a1864f4b839fa4f75993a5b5f95ca6a6a7225944c8cff1b 1658792
vim-doc_7.3.547-6_all.deb
b2b6e9e91dd07756f6157bb929b6f01661abcbd9c3d3e6c7bddc3ec571857adf 87084
vim-lesstif_7.3.547-6_all.deb
0d0f294a59aa2ba6c8c3e539ee6d07269b1b3f148fdd1467b538b8e1a8fcf732 354684
vim-tiny_7.3.547-6_amd64.deb
c544ebb3f5893c3450e17012f605bfe3b119f17f2997ea6af61817c7c6cdadba 1035050
vim-gtk_7.3.547-6_amd64.deb
527740537559d54197f5b2caf7cbea63c4337b3461d7cf6d2c49bc7b00e0a9e8 1036932
vim-gnome_7.3.547-6_amd64.deb
4eb708807c88edc3ebfb97cc2da3cf17fc791b122f5d64d0bf318231d9fe5ee6 1024716
vim-athena_7.3.547-6_amd64.deb
a6a872c55e6f8869acb891ff865a911759e3c47f0bdf40996e22f7232e34ae95 924704
vim-nox_7.3.547-6_amd64.deb
130459958daa523c3aed51b31b2722a405663c0067e8865d46f202b2ca4a0f91 162572
vim-common_7.3.547-6_amd64.deb
3ed89b99d1ccc0cba20ad3aa17f04a5ec779aec1062be6440139e5da743b242a 841324
vim_7.3.547-6_amd64.deb
b96c1e92e3fafddbde32184d5bc5a4ed8f1898fa5dd3cbb0b6b224cbeb14c5a8 7778446
vim-dbg_7.3.547-6_amd64.deb
Files:
71fa9612e71969e1ada7b0ba205d8c16 1992 editors optional vim_7.3.547-6.dsc
042ab9224f6224b847cff2420e448a4c 190402 editors optional
vim_7.3.547-6.debian.tar.gz
76a4c8b421932c1fb1fb51a68037a318 142894 editors optional
vim-gui-common_7.3.547-6_all.deb
37f3e2d82bfd21ed2625e4870f962153 4606290 editors optional
vim-runtime_7.3.547-6_all.deb
acd40fe5580713df85a1742bbc4ad165 1658792 doc optional vim-doc_7.3.547-6_all.deb
8bbc0acdfa48c6412780b3b63bd60b92 87084 oldlibs extra
vim-lesstif_7.3.547-6_all.deb
48fbeaf81d181a5be85f5818e31bb874 354684 editors important
vim-tiny_7.3.547-6_amd64.deb
50248231b6c870bc193b32224ce7416f 1035050 editors extra
vim-gtk_7.3.547-6_amd64.deb
9ad74f682742ff84e28d9a1f781c6e9b 1036932 editors extra
vim-gnome_7.3.547-6_amd64.deb
a91c65851b56d4730e1a88b1835823d5 1024716 editors extra
vim-athena_7.3.547-6_amd64.deb
145f98bf859a21b7d21869134ef03fe1 924704 editors extra
vim-nox_7.3.547-6_amd64.deb
6efee6e49d97b016f8a586427450ef9b 162572 editors important
vim-common_7.3.547-6_amd64.deb
f6838d9564d3b18db1be8ace917ca46f 841324 editors optional
vim_7.3.547-6_amd64.deb
6e9f5dcc2e808177b414ed2b3cdad331 7778446 debug extra
vim-dbg_7.3.547-6_amd64.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
iEYEARECAAYFAlCuPloACgkQDb3UpmEybUCZ9wCdFExGdOTuGaEbKaPLGYPwmy8d
PTMAoIPOWlqX8uBQK/qshVg1kDHYfNJq
=LhTW
-----END PGP SIGNATURE-----
--- End Message ---
