Secunia

SUSE has issued an update for permissions. This fixes a vulnerability, which can be exploited by malicious, local users to bypass certain security restrictions.

The vulnerability is caused due to the way "chkstat" tries to prevent symlink attacks by not changing the permissions of files that has a hardlink count of more than one. This can be bypassed by creating a hardlink to the targeted file. When the file has been deleted and replaced by a new one by its owner, the hardlink count of the file created by the malicious user will decrease to one, thus allowing the permissions of the targeted file to be changed.

Solution
Apply updated packages.
Further details available in Customer Area

Provided and/or discovered by
The vendor credits Stefan Nordhausen.

Original Advisory
http://lists.suse.com/archive/suse-security-announce/2005-Oct/0008.html

Deep Links
Links available in Customer Area