John Lightsey of the Debian Security Audit project discovered that the super package did not check for setuid failures, allowing local users to increase the privileges on kernel versions which do not guard against RLIMIT_NPROC attacks.

For the oldstable distribution (squeeze), this problem has been fixed in version 3.30.0-3+squeeze2. For the stable distribution (wheezy), this problem has been fixed in version 3.30.0-6+deb7u1. We recommend that you upgrade your super packages.

Super allows specified users to execute scripts (or other commands) as if they were root or it can set the uid and/or gid on a per-command basis before executing the command. It is intended to be a secure alternative to making scripts setuid root.

super on Debian Linux

This check tests the installed software version using the apt package manager.

• http://www.debian.org/security/2014/dsa-2917.html

---

Updated on 2015-03-25