Debian – How to patch CVE-2015-0235 (GHOST) on Debian Lenny and Squeeze

The problem comes from a preinst script (a package maintainer script that is run before the installation of the package). It is likely to be '/var/lib/dpkg/info/sysv-rc.preinst'

touch fails to set the modification date of /etc/init.d/.legacy-bootordering.

Try to 'touch' any file yourself. Try to delete it and rerun it.

Did apt upgrade the glibc before sysv-rc ? There are many bugreport concerning that problem, not only on Debian.

Look for "touch bad address" on search engines...

I believe this is something related to both (kernel + libc)

I found this post on superuser.com, indicating that it can't be done. Aparently the network installer, always grabs the latest stable packages. Now I will try to find out how to preseed a full-iso-install, rather than a network-install.

(If you like this, I'd suggest you upvote the original answer, not my repeat of it).

Update: Got it working by

• Placing the preseed file on an internally reachable webserver, URL: http://<webserver>/d-i/lenny/preseed.cfg
• Booting a VM off the debian-506-amd64-netinst.iso
• At the splash screen I hit ESC to get to the boot prompt
• At the boot prompt I type in auto url=<webserver>