Debian Security Advisory

DSA-154-1 fam -- privilege escalation

Date Reported:

15 Aug 2002

Affected Packages:

fam

Vulnerable:

Yes

Security database references:

In the Bugtraq database (at SecurityFocus): BugTraq ID 5487.
In Mitre's CVE dictionary: CVE-2002-0875.

More information:

A flaw was discovered in FAM's group handling. In the effect users are unable to read FAM directories they have group read and execute permissions on. However, also unprivileged users can potentially learn names of files that only users in root's group should be able to view.

This problem been fixed in version 2.6.6.1-5.2 for the current stable stable distribution (woody) and in version 2.6.8-1 (or any later version) for the unstable distribution (sid). The old stable distribution (potato) is not affected, since it doesn't contain fam packages.

We recommend that you upgrade your fam packages.

Fixed in:

Debian GNU/Linux 3.0 (woody)

Source:: http://security.debian.org/pool/updates/main/f/fam/fam_2.6.6.1-5.2.dsc; http://security.debian.org/pool/updates/main/f/fam/fam_2.6.6.1-5.2.diff.gz; http://security.debian.org/pool/updates/main/f/fam/fam_2.6.6.1.orig.tar.gz
Alpha:: http://security.debian.org/pool/updates/main/f/fam/fam_2.6.6.1-5.2_alpha.deb; http://security.debian.org/pool/updates/main/f/fam/libfam-dev_2.6.6.1-5.2_alpha.deb; http://security.debian.org/pool/updates/main/f/fam/libfam0_2.6.6.1-5.2_alpha.deb
ARM:: http://security.debian.org/pool/updates/main/f/fam/fam_2.6.6.1-5.2_arm.deb; http://security.debian.org/pool/updates/main/f/fam/libfam-dev_2.6.6.1-5.2_arm.deb; http://security.debian.org/pool/updates/main/f/fam/libfam0_2.6.6.1-5.2_arm.deb
Intel IA-32:: http://security.debian.org/pool/updates/main/f/fam/fam_2.6.6.1-5.2_i386.deb; http://security.debian.org/pool/updates/main/f/fam/libfam-dev_2.6.6.1-5.2_i386.deb; http://security.debian.org/pool/updates/main/f/fam/libfam0_2.6.6.1-5.2_i386.deb
Intel IA-64:: http://security.debian.org/pool/updates/main/f/fam/fam_2.6.6.1-5.2_ia64.deb; http://security.debian.org/pool/updates/main/f/fam/libfam-dev_2.6.6.1-5.2_ia64.deb; http://security.debian.org/pool/updates/main/f/fam/libfam0_2.6.6.1-5.2_ia64.deb
HP Precision:: http://security.debian.org/pool/updates/main/f/fam/fam_2.6.6.1-5.2_hppa.deb; http://security.debian.org/pool/updates/main/f/fam/libfam-dev_2.6.6.1-5.2_hppa.deb; http://security.debian.org/pool/updates/main/f/fam/libfam0_2.6.6.1-5.2_hppa.deb
Motorola 680x0:: http://security.debian.org/pool/updates/main/f/fam/fam_2.6.6.1-5.2_m68k.deb; http://security.debian.org/pool/updates/main/f/fam/libfam-dev_2.6.6.1-5.2_m68k.deb; http://security.debian.org/pool/updates/main/f/fam/libfam0_2.6.6.1-5.2_m68k.deb
Big endian MIPS:: http://security.debian.org/pool/updates/main/f/fam/fam_2.6.6.1-5.2_mips.deb; http://security.debian.org/pool/updates/main/f/fam/libfam-dev_2.6.6.1-5.2_mips.deb; http://security.debian.org/pool/updates/main/f/fam/libfam0_2.6.6.1-5.2_mips.deb
Little endian MIPS:: http://security.debian.org/pool/updates/main/f/fam/fam_2.6.6.1-5.2_mipsel.deb; http://security.debian.org/pool/updates/main/f/fam/libfam-dev_2.6.6.1-5.2_mipsel.deb; http://security.debian.org/pool/updates/main/f/fam/libfam0_2.6.6.1-5.2_mipsel.deb
PowerPC:: http://security.debian.org/pool/updates/main/f/fam/fam_2.6.6.1-5.2_powerpc.deb; http://security.debian.org/pool/updates/main/f/fam/libfam-dev_2.6.6.1-5.2_powerpc.deb; http://security.debian.org/pool/updates/main/f/fam/libfam0_2.6.6.1-5.2_powerpc.deb
IBM S/390:: http://security.debian.org/pool/updates/main/f/fam/fam_2.6.6.1-5.2_s390.deb; http://security.debian.org/pool/updates/main/f/fam/libfam-dev_2.6.6.1-5.2_s390.deb; http://security.debian.org/pool/updates/main/f/fam/libfam0_2.6.6.1-5.2_s390.deb
Sun Sparc:: http://security.debian.org/pool/updates/main/f/fam/fam_2.6.6.1-5.2_sparc.deb; http://security.debian.org/pool/updates/main/f/fam/libfam-dev_2.6.6.1-5.2_sparc.deb; http://security.debian.org/pool/updates/main/f/fam/libfam0_2.6.6.1-5.2_sparc.deb

MD5 checksums of the listed files are available in the original advisory.