The xmcd package has historically installed two setuid helpers (in Debian, and other UNIX systems) for accessing cddb databases and SCSI cdrom drives. More recently, the package offered the administrator the chance to remove these setuid flags, but did so incorrectly.
Vulnerable systems:
Debian GNU/Linux 2.1 alias slink
Debian GNU/Linux 2.2 (stable) alias potato
A buffer overflow in ncurses, linked to the "cda" binary, allowed a root exploit. Fixed ncurses packages have been released, as well as fixed xmcd packages that do not install this binary with a setuid flag.
The problem is fixed in xmcd 2.5pl1-7.1, and it is recommended that all users that have xmcd installed upgrade to this release. You may need to add users of xmcd to the "audio" and "cdrom" groups in order for them to continue using xmcd.
Patch: Debian GNU/Linux 2.1 alias slink
Slink is no longer being supported by the Debian Security Team. It is highly recommended to upgrade to the current stable release.
Debian GNU/Linux 2.2 (stable) alias potatoFixes are currently available for the Alpha, ARM, Intel ia32, Motorola 680x0, PowerPC and Sun SPARC architectures, and will be included in 2.2r2.
