[SECURITY] [DSA-330-1] New tcptraceroute packages fix failure to drop root privileges From: Matt Zimmerman <mdz@debian.org> To: bugtraq@securityfocus.com Date: Today 02.39.16 Message was signed with unknown key 0x43E25D1E. The validity of the signature cannot be verified. -------------------------------------------------------------------------- Debian Security Advisory DSA 330-1 security@debian.org http://www.debian.org/security/ Matt Zimmerman June 23rd, 2003 http://www.debian.org/security/faq -------------------------------------------------------------------------- Package : tcptraceroute Vulnerability : failure to drop root privileges Problem-Type : local Debian-specific: no tcptraceroute is a setuid-root program which drops root privileges after obtaining a file descriptor used for raw packet capture. However, it did not fully relinquish all privileges, and in the event of an exploitable vulnerability, root privileges could be regained. No current exploit is known, but this safeguard is being repaired in order to provide a measure of containment in the event that an exploitable flaw should be discovered. For the stable distribution (woody) this problem has been fixed in version 1.2-2. The old stable distribution (potato) does not contain a tcptraceroute package. For the unstable distribution (sid) this problem is fixed in version 1.4-4. We recommend that you update your tcptraceroute package.
glsa sent
