Debian Security Advisory

DSA-154-1 fam -- privilege escalation

Date Reported:
15 Aug 2002
Affected Packages:
Security database references:
In the Bugtraq database (at SecurityFocus): BugTraq ID 5487.
In Mitre's CVE dictionary: CVE-2002-0875.
More information:

A flaw was discovered in FAM's group handling. In the effect users are unable to read FAM directories they have group read and execute permissions on. However, also unprivileged users can potentially learn names of files that only users in root's group should be able to view.

This problem been fixed in version for the current stable stable distribution (woody) and in version 2.6.8-1 (or any later version) for the unstable distribution (sid). The old stable distribution (potato) is not affected, since it doesn't contain fam packages.

We recommend that you upgrade your fam packages.

Fixed in:

Debian GNU/Linux 3.0 (woody)

Intel IA-32:
Intel IA-64:
HP Precision:
Motorola 680x0:
Big endian MIPS:
Little endian MIPS:
IBM S/390:
Sun Sparc:

MD5 checksums of the listed files are available in the original advisory.