Subject: SECURITY: Announcing Splitvt 1.6.3
Newsgroups: alt.sources
Summary: 
Keywords: 


Announcing the newest version of splitvt!

SECURITY ALERT!!!

	splitvt versions lower than 1.6.3 are known to have a
security hole allowing a user to gain ROOT access on some systems!

	If you have a version lower than 1.6.3 _please_ remove
the set-uid bit on your current version, and upgrade to the newer
version as soon as possible.
("splitvt -version" will tell you what version you are running)

The set-uid bit is only for updating the utmp database and for
changing ownership of its pseudo-terminals.  It is not necessary
for splitvt's operation.

The latest version is available via anonymous ftp from 
dandelion.ceres.ca.gov in the /pub/splitvt directory.

The output of md5sum on the TAR file splitvt-1.6.3.tar is:
eec2fe2c5b4a3958261197905a9d9c81  splitvt-1.6.3.tar


What it is:

	Splitvt is a program that splits any vt100 compatible 
screen into two - an upper and lower window in which you can run
two programs at the same time.  Splitvt differs from screen in 
that while screen gives you multiple virtual screens, splitvt splits
your screen into two fully visible windows.  You can even use 
splitvt with screen to provide multiple split screens.  This can 
be very handy when running over a modem, or for developing
client-server applications.

What can I use it for?

	Well, at this time, I am aware of several ways in which
people are using splitvt.  Some people like to use it over the modem
to allow them more than one window at a time, others like to use it
in xterms because they prefer having everything on the screen at once,
and some people are using it in conjunction with the -rcfile option 
to automate system administration tasks.
	If you are using splitvt in a new and unusual way,
I'd like to hear about it! 
Direct all comments to slouken@cs.ucdavis.edu

Where can I get it?

	Splitvt is available for anonymous ftp from
dandelion.ceres.ca.gov in the /pub/Linux/splitvt directory.
You can also get it from sunsite.unc.edu in /pub/Linux/Incoming
now, and will hopefully to be moved to /pub/Linux/utils/terminal.
The file is splitvt-1.6.3.tgz and it is in tarred and gzipped format.

What's new?

	Lots of stuff. :)
Here is the list of things from the CHANGES file:

	Version 1.6.3
			Patched some security holes:
				fixed sprintf overflow in parserc.c
				fixed env label overflow in parserc.c
				fixed env variable expansion overflow
				added read access check in parserc.c
				added chdir() access check in parserc.c
				fixed sprintf overflow in vtmouse.c

	Version 1.6.2
			Fixed a bug in vt_showscreen()
			Fixed separator redisplay in vt_prompt()
			Added the ANNOUNCE file
			Added a "cd" command to the startup file
			Added -t option to change xterm title
			xterm title is reset, if possible, at exit
			Added xterm drag-n-drop of separator bar
			Speeded up separator bar movement
(broken)		Fixed cut-paste highlighting
(broken)		Integrated cut-paste with X selection (xcb)
			Fixed job control for FreeBSD
					(thanks to Quang Ngo)
			Fixed bug in cursor keys (showed up in vi)
----

What's planned?

	I want to beef up the startup file syntax so that you can
specify the format of the "status bar", or window divider, and I plan
to rewrite the startup file parser so that it allows you to use more
flexible and powerful startup scripts.  I am also toying with the idea
of cut-paste "screen" style, and a window history that you can scroll
back through.  I have cut-paste partially working.
Other things on the pot are cleaning up dead windows, dynamically starting
new windows, etc...
	If you have any wishes, just let me know at slouken@cs.ucdavis.edu,
and I'll try to include them in future releases of splitvt.  I'll try to 
avoid feeping creaturism, but a few bells and whistles would be nice. :)

Note: At the moment I have several other projects, and have this one on
      unspecified hold.  This release was mainly to fix some security holes.

Will it run on my system?

	Well, if you run a UNIX that has pseudo-tty support, 
chances are that splitvt will work on your system.  Splitvt has
been ported to all of the "standard" unices, and also to a few
oddball unices, such as AIX, NewsOS, MP-RAS, and NeXT.

Well, that about wraps it up.  I hope you enjoy this software,
originally conceived by Dave Ljung and created by yours truly.


Enjoy!

	-Sam Lantinga		(slouken@cs.ucdavis.edu)