CVE request: tss <= 0.8.1-3: arbitary file reading

[Steve Kemp <steve () steve org uk>]

  Due to a lack of permissions checking, or privilege reduction
 the setuid(0) binary tss allows local users to read arbitrary files
 upon the local system.

  Sample "exploit" is:

              skx@gold:~$ tss -a /etc/shadow

  This opens up a console-based screen-saver displaying the animated
 contents of the shadow-file.

  Reference: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=475747

Steve
-- 
Debian GNU/Linux System Administration
http://www.debian-administration.org/