Debian Security Advisory

DSA-004-1 nano -- symlink attack

Date Reported:

17 Dec 2000

Affected Packages:

nano, nano-tiny

Vulnerable:

Yes

Security database references:

No other external database security references currently available.

More information:

The problem that was previously reported for joe has been found in other editors. When nano (a free pico clone) unexpectedly dies it tries a warning message to a new file with a predictable name (the name of the file being edited with ".save" appended). Unfortunately that file was not created safely which made nano vulnerable to a symlink attack.

This has been fixed in version 0.9.23-1 (except for powerpc, which has version 0.9.23-1.1).

Fixed in:

Debian 2.2 (potato)

Source:: http://security.debian.org/dists/stable/updates/main/source/nano_0.9.23-1.diff.gz; http://security.debian.org/dists/stable/updates/main/source/nano_0.9.23-1.dsc; http://security.debian.org/dists/stable/updates/main/source/nano_0.9.23.orig.tar.gz
alpha:: http://security.debian.org/dists/stable/updates/main/binary-alpha/nano-tiny_0.9.23-1_alpha.deb; http://security.debian.org/dists/stable/updates/main/binary-alpha/nano_0.9.23-1_alpha.deb
arm:: http://security.debian.org/dists/stable/updates/main/binary-arm/nano-tiny_0.9.23-1_arm.deb; http://security.debian.org/dists/stable/updates/main/binary-arm/nano_0.9.23-1_arm.deb
i386:: http://security.debian.org/dists/stable/updates/main/binary-i386/nano-tiny_0.9.23-1_i386.deb; http://security.debian.org/dists/stable/updates/main/binary-i386/nano_0.9.23-1_i386.deb
m68k:: http://security.debian.org/dists/stable/updates/main/binary-m68k/nano-tiny_0.9.23-1_m68k.deb; http://security.debian.org/dists/stable/updates/main/binary-m68k/nano_0.9.23-1_m68k.deb
powerpc:: http://security.debian.org/dists/stable/updates/main/binary-powerpc/nano-tiny_0.9.23-1.1_powerpc.deb; http://security.debian.org/dists/stable/updates/main/binary-powerpc/nano_0.9.23-1.1_powerpc.deb
sparc:: http://security.debian.org/dists/stable/updates/main/binary-sparc/nano-tiny_0.9.23-1_sparc.deb; http://security.debian.org/dists/stable/updates/main/binary-sparc/nano_0.9.23-1_sparc.deb