linux-kernel - Do people exaggerate in security advisories?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <fll7u3$p02$1@ger.gmane.org>
Date:	Fri, 04 Jan 2008 13:21:32 +0100
From:	Manuel Reimer <Manuel.Spam@...fuerspam.de>
To:	linux-kernel@...r.kernel.org
Subject:  Do people exaggerate in security advisories?

Hi,

I found this one today:

http://securitytracker.com/alerts/2007/Oct/1018782.html

In the git changelog:

http://git.kernel.org/?p=utils/util-linux-ng/util-linux-ng.git;a=commit;h=ebbeb2c7ac1b00b608390595783
7a271e80b187e

noone leaves any word about privilege escalation.

Is it really possible to get root privileges with this bug or are there 
people who just write "may be used to escalate privileges" near any bug 
which has something to do with "setuid" or "setgid"?

Thanks in advance

CU

Manuel

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/