Debian Security Advisory

DSA-154-1 fam -- privilege escalation

Date Reported:
15 Aug 2002
Affected Packages:
fam
Vulnerable:
Yes
Security database references:
In the Bugtraq database (at SecurityFocus): BugTraq ID 5487.
In Mitre's CVE dictionary: CVE-2002-0875.
More information:

A flaw was discovered in FAM's group handling. In the effect users are unable to read FAM directories they have group read and execute permissions on. However, also unprivileged users can potentially learn names of files that only users in root's group should be able to view.

This problem been fixed in version 2.6.6.1-5.2 for the current stable stable distribution (woody) and in version 2.6.8-1 (or any later version) for the unstable distribution (sid). The old stable distribution (potato) is not affected, since it doesn't contain fam packages.

We recommend that you upgrade your fam packages.

Fixed in:

Debian GNU/Linux 3.0 (woody)

Source:
http://security.debian.org/pool/updates/main/f/fam/fam_2.6.6.1-5.2.dsc
http://security.debian.org/pool/updates/main/f/fam/fam_2.6.6.1-5.2.diff.gz
http://security.debian.org/pool/updates/main/f/fam/fam_2.6.6.1.orig.tar.gz
Alpha:
http://security.debian.org/pool/updates/main/f/fam/fam_2.6.6.1-5.2_alpha.deb
http://security.debian.org/pool/updates/main/f/fam/libfam-dev_2.6.6.1-5.2_alpha.deb
http://security.debian.org/pool/updates/main/f/fam/libfam0_2.6.6.1-5.2_alpha.deb
ARM:
http://security.debian.org/pool/updates/main/f/fam/fam_2.6.6.1-5.2_arm.deb
http://security.debian.org/pool/updates/main/f/fam/libfam-dev_2.6.6.1-5.2_arm.deb
http://security.debian.org/pool/updates/main/f/fam/libfam0_2.6.6.1-5.2_arm.deb
Intel IA-32:
http://security.debian.org/pool/updates/main/f/fam/fam_2.6.6.1-5.2_i386.deb
http://security.debian.org/pool/updates/main/f/fam/libfam-dev_2.6.6.1-5.2_i386.deb
http://security.debian.org/pool/updates/main/f/fam/libfam0_2.6.6.1-5.2_i386.deb
Intel IA-64:
http://security.debian.org/pool/updates/main/f/fam/fam_2.6.6.1-5.2_ia64.deb
http://security.debian.org/pool/updates/main/f/fam/libfam-dev_2.6.6.1-5.2_ia64.deb
http://security.debian.org/pool/updates/main/f/fam/libfam0_2.6.6.1-5.2_ia64.deb
HP Precision:
http://security.debian.org/pool/updates/main/f/fam/fam_2.6.6.1-5.2_hppa.deb
http://security.debian.org/pool/updates/main/f/fam/libfam-dev_2.6.6.1-5.2_hppa.deb
http://security.debian.org/pool/updates/main/f/fam/libfam0_2.6.6.1-5.2_hppa.deb
Motorola 680x0:
http://security.debian.org/pool/updates/main/f/fam/fam_2.6.6.1-5.2_m68k.deb
http://security.debian.org/pool/updates/main/f/fam/libfam-dev_2.6.6.1-5.2_m68k.deb
http://security.debian.org/pool/updates/main/f/fam/libfam0_2.6.6.1-5.2_m68k.deb
Big endian MIPS:
http://security.debian.org/pool/updates/main/f/fam/fam_2.6.6.1-5.2_mips.deb
http://security.debian.org/pool/updates/main/f/fam/libfam-dev_2.6.6.1-5.2_mips.deb
http://security.debian.org/pool/updates/main/f/fam/libfam0_2.6.6.1-5.2_mips.deb
Little endian MIPS:
http://security.debian.org/pool/updates/main/f/fam/fam_2.6.6.1-5.2_mipsel.deb
http://security.debian.org/pool/updates/main/f/fam/libfam-dev_2.6.6.1-5.2_mipsel.deb
http://security.debian.org/pool/updates/main/f/fam/libfam0_2.6.6.1-5.2_mipsel.deb
PowerPC:
http://security.debian.org/pool/updates/main/f/fam/fam_2.6.6.1-5.2_powerpc.deb
http://security.debian.org/pool/updates/main/f/fam/libfam-dev_2.6.6.1-5.2_powerpc.deb
http://security.debian.org/pool/updates/main/f/fam/libfam0_2.6.6.1-5.2_powerpc.deb
IBM S/390:
http://security.debian.org/pool/updates/main/f/fam/fam_2.6.6.1-5.2_s390.deb
http://security.debian.org/pool/updates/main/f/fam/libfam-dev_2.6.6.1-5.2_s390.deb
http://security.debian.org/pool/updates/main/f/fam/libfam0_2.6.6.1-5.2_s390.deb
Sun Sparc:
http://security.debian.org/pool/updates/main/f/fam/fam_2.6.6.1-5.2_sparc.deb
http://security.debian.org/pool/updates/main/f/fam/libfam-dev_2.6.6.1-5.2_sparc.deb
http://security.debian.org/pool/updates/main/f/fam/libfam0_2.6.6.1-5.2_sparc.deb

MD5 checksums of the listed files are available in the original advisory.