Description
GNU userv 1.0.0 and earlier does not properly perform file descriptor swapping, which can corrupt the USERV_GROUPS and USERV_GIDS environmental variables and allow local users to bypass some access restrictions.
References
- 20000726 userv security boundary tool 1.0.1 (SECURITY FIX) mailing-list
- 1516 vdb-entry
- http://marc.info/?l=bugtraq&m=96473640717095&w=2
- 20000727 userv: local exploit vendor-advisory