[Secure-testing-team] Bug#653959: citadel-server was auto-selected and installed by dist-upgrade for what appears to be no good reason, and apt-get purge citadel-server failed to back out all system changes

[Joshua]

Source: citadel-server
Version: wheezy
Severity: serious
Tags: security
Justification: Policy 3.5

apt-get dist-upgrade decided to install citadel-server (no I didn't know what it was) for who-knows-what reason.
Install created a new publicly listening service (never a good thing security-wise)
Install created a new user & group
an immediate apt-get purge citadel-server failed to back out the user,group,extra directories in /var

Dear Maintainer,
*** Please consider answering these questions, where appropriate ***

   * What led up to the situation?
   * What exactly did you do (or not do) that was effective (or
     ineffective)?
   * What was the outcome of this action?
   * What outcome did you expect instead?

*** End of the template - remove these lines ***


-- System Information:
Debian Release: wheezy/sid
  APT prefers testing
  APT policy: (500, 'testing')
Architecture: amd64 (x86_64)

Kernel: Linux 3.0.0-1-amd64 (SMP w/2 CPU cores)
Locale: LANG=en_US, LC_CTYPE=en_US (charmap=ISO-8859-1)
Shell: /bin/sh linked to /bin/dash