We have a report covering a buffer overflow in the inews
program as provided by the INN news server. This program is used by local
clients to inject news articles to the server. In order to be able to connect
to the news server through a Unix domain socket it needs to run setgid "news".
By exploiting this bug local users can gain "news" privileges. After that they
are able to modify the configuration for the INN server as well as destroy News
databases and files. We recommend upgrading your inews-inn package
immediately.
