Debian Security Advisory DSA 787-1 (backup manager)

The remote host is missing an update to backup manager announced via advisory DSA 787-1. Two bugs have been found in backup-manager, a command-line driven backup utility. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2005-1855 Jeroen Vermeulen discovered that backup files are created with default permissions making them world readable, even though they may contain sensitive information. CVE-2005-1856 Sven Joachim discovered that the optional CD-burning feature of backup-manager uses a hardcoded filename in a world-writable directory for logging. This can be subject to a symlink attack. The old stable distribution (woody) does not provide the backup-manager package.

For the stable distribution (sarge) these problems have been fixed in version 0.5.7-1sarge1. For the unstable distribution (sid) these problems have been fixed in version 0.5.8-2. We recommend that you upgrade your backup-manager package. https://secure1.securityspace.com/smysecure/catid.html?in=DSA%20787-1