Secure testing team - Mar 2010 - Bug#572937: Multiple security issues

Package: ncpfs
Severity: grave
Tags: security

Please see http://seclists.org/fulldisclosure/2010/Mar/122 for details
and a patch.

I don''t know why the ncp mount needs to be setuid root in the first,
dropping the setuidness seems like an equally adequate fix to me.

Cheers,
        Moritz

-- System Information:
Debian Release: squeeze/sid
  APT prefers unstable
  APT policy: (500, ''unstable'')
Architecture: i386 (i686)

Kernel: Linux 2.6.32-2-686 (SMP w/1 CPU core)
Locale: LANG=C, LC_CTYPE=de_DE.ISO-8859-15 at euro (charmap=ISO-8859-15)
Shell: /bin/sh linked to /bin/bash

Versions of packages ncpfs depends on:
ii  libc6                         2.10.2-6   Embedded GNU C Library: Shared lib
ii  libncp                        2.2.6-6    shared library used by programs th
ii  libpam-ncp                    2.2.6-6    PAM module allowing authentication

ncpfs recommends no packages.

Versions of packages ncpfs suggests:
pn  ipx                           <none>     (no description available)