[19022] in bugtraq
Re: SuSe / Debian man package format string vulnerability
daemon@ATHENA.MIT.EDU (Matt Zimmerman)
Mon Feb 5 21:19:35 2001
Mail-Followup-To: BUGTRAQ@SECURITYFOCUS.COM
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Message-ID: <20010205153328.L13606@alcor.net>
Date: Mon, 5 Feb 2001 15:33:29 -0500
Reply-To: Matt Zimmerman <mdz@DEBIAN.ORG>
From: Matt Zimmerman <mdz@DEBIAN.ORG>
To: BUGTRAQ@SECURITYFOCUS.COM
In-Reply-To: <3A7E8FD7.FF012EF3@hushmail.com>; from johns@HUSHMAIL.COM on Mon,
Feb 05, 2001 at 06:34:47AM -0500
On Mon, Feb 05, 2001 at 06:34:47AM -0500, John wrote:
> On my Debian 2.2 system 'man' was installed
> suid root. I don't know about Debian 2.3 but,
> Debian 2.2 does install 'man' suid root.
Are you certain? In Debian stable (2.2, potato), man is installed setgid man.
In Debian unstable and testing (sid, woody), man is now installed setuid man
(for reasons noted elsewhere in this thread).
If you actually have a situation where man has been installed setuid root, it
would be a very serious bug, and you should report which architecture and
version of the man-db package you are using.
--
- mdz
