Security Information / 2014 / Security Information -- DSA-2917-1 super

Debian Security Advisory

DSA-2917-1 super -- security update

Date Reported:

28 Apr 2014

Affected Packages:

super

Vulnerable:

Yes

Security database references:

In Mitre's CVE dictionary: CVE-2014-0470.

More information:

John Lightsey of the Debian Security Audit project discovered that the super package did not check for setuid failures, allowing local users to increase the privileges on kernel versions which do not guard against RLIMIT_NPROC attacks.

For the oldstable distribution (squeeze), this problem has been fixed in version 3.30.0-3+squeeze2.

For the stable distribution (wheezy), this problem has been fixed in version 3.30.0-6+deb7u1.

We recommend that you upgrade your super packages.