Package: coreutils Version: 8.13-3 Severity: important Hello! Sorry my bad English
chown/chgrp illegally reset suid/sgid. I think this is critical, as it is often used in [post/pre]install scripts, see Bug #664206. globus@aspera:~/mia/tmp$ ls -l -rwxr-xr-x 1 globus globus 12 Мар 24 17:12 testp globus@aspera:~/mia/tmp$ chmod 2755 testp globus@aspera:~/mia/tmp$ ls -l -rwxr-sr-x 1 globus globus 12 Мар 24 17:12 testp globus@aspera:~/mia/tmp$ chown globus:tempo testp globus@aspera:~/mia/tmp$ ls -l testp -rwxr-xr-x 1 globus tempo 12 Мар 24 17:12 testp globus@aspera:~/mia/tmp$ chmod 6755 testp globus@aspera:~/mia/tmp$ ls -l testp -rwsr-sr-x 1 globus tempo 12 Мар 24 17:12 testp globus@aspera:~/mia/tmp$ chown globus:globus testp globus@aspera:~/mia/tmp$ ls -l testp -rwxr-xr-x 1 globus globus 12 Мар 24 17:12 testp globus@aspera:~/mia/tmp$ chmod 7755 testp globus@aspera:~/mia/tmp$ ls -l testp -rwsr-sr-t 1 globus globus 12 Мар 24 17:12 testp globus@aspera:~/mia/tmp$ chown globus:globus testp globus@aspera:~/mia/tmp$ ls -l testp -rwxr-xr-t 1 globus globus 12 Мар 24 17:12 testp globus@aspera:~/mia/tmp$ chmod 6755 testp globus@aspera:~/mia/tmp$ ls -l testp -rwsr-sr-x 1 globus globus 12 Мар 24 17:12 testp globus@aspera:~/mia/tmp$ chgrp tempo testp globus@aspera:~/mia/tmp$ ls -l testp -rwxr-xr-x 1 globus tempo 12 Мар 24 17:12 testp -- System Information: Debian Release: wheezy/sid APT prefers testing-proposed-updates APT policy: (500, 'testing-proposed-updates'), (500, 'testing') Architecture: i386 (x86_64) Kernel: Linux 3.2.0-2-amd64 (SMP w/2 CPU cores) Locale: LANG=ru_RU.UTF-8, LC_CTYPE=ru_RU.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash Versions of packages coreutils depends on: ii dpkg 1.16.1.2 ii install-info 4.13a.dfsg.1-8 ii libacl1 2.2.51-5 ii libattr1 1:2.4.46-5 ii libc6 2.13-27 ii libselinux1 2.1.9-2 coreutils recommends no packages. coreutils suggests no packages. -- no debconf information -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
