[linux-security] more joe bugs

[Martin Siegert <siegert@sfu.ca>]

Topic
=====
insecure search path for .joerc file

Problem Description
===================
joe (Joe's Own Editor) will look for a configuration file in three
locations: the current directory, the users homedirectory ($HOME)
and in /etc/joe. Since the configuration file can define commands
joe will run (for example to check spelling) reading it from
the current directory can be dangerous: an attacker can leave
a .joerc file in a writable directory, which would be read when
a unsuspecting user starts joe in that directory.

Affected Systems
================
All systems that have joe installed.

Workaround (recommended)
========================
Use a different editor. This is the second vulnerability found in joe within
a short time.

Solution
========
RedHat 6.x
rpm -Fvh joe-2.8-43.62.i386.rpm

RedHat 7.0
rpm -Fvh joe-2.8-43.7.i386.rpm

Debian 2.2 (potato)
upgrade to joe_2.8-15.3_i386.deb

Mandrake 6.x, 7.0
rpm -Fvh joe-2.8-21.6mdk.i586.rpm

Mandrake 7.1
rpm -Fvh joe-2.8-21.5mdk.i586.rpm

Mandrake 7.2
rpm -Fvh joe-2.8-21.4mdk.i586.rpm