CVE-2006-7094

ftpd, as used by Gentoo and Debian Linux, sets the gid to the effective uid instead of the effective group id before executing /bin/ls, which allows remote authenticated users to list arbitrary directories with the privileges of gid 0 and possibly enable additional attack vectors...

/bin/ls with gid=0 in Debian linux-ftpd

Mea culpa. A stupid little bug crept into linux-ftpd for Debian, and some other Linux distros. Some may have fixed it, but Debian hasn't. The effect is that ftpd now runs /bin/ls for DIR and similar commands with GID=0. Does not seem terribly dangerous as I do not seem able to trick ls into runni...

Linux ftpd ls privilege escalation

ls command is executed with effective gid 0...