Re: SuSe / Debian man package format string vulnerability

[Matt Zimmerman]

On Mon, Feb 05, 2001 at 06:34:47AM -0500, John wrote:

> On my Debian 2.2 system 'man' was installed
> suid root. I don't know about Debian 2.3 but,
> Debian 2.2 does install 'man' suid root.

Are you certain?  In Debian stable (2.2, potato), man is installed setgid man.
In Debian unstable and testing (sid, woody), man is now installed setuid man
(for reasons noted elsewhere in this thread).

If you actually have a situation where man has been installed setuid root, it
would be a very serious bug, and you should report which architecture and
version of the man-db package you are using.

--
 - mdz