Bug#849707: gksu grants root priveleges without password

[Darrin Swanson]

Package: gksu
Version: 2.0.2-9
Severity: important

Dear Maintainer,

I installed gksu on a new jessie 8.6 system; it grants super user privelege
without prompting for root password.

I have searched for solutions on the internet, but found none. Uninstalling and
reinstalling gksu doesn't solve the issue. I have found no keyrings which may
be storing the root password.

This is a serious security breach.



-- System Information:
Debian Release: 8.6
  APT prefers stable-updates
  APT policy: (500, 'stable-updates'), (500, 'proposed-updates'), (500, 'stable')
Architecture: amd64 (x86_64)

Kernel: Linux 3.16.0-4-amd64 (SMP w/2 CPU cores)
Locale: LANG=en_US.utf8, LC_CTYPE=en_US.utf8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages gksu depends on:
ii  gconf-service             3.2.6-3
ii  libatk1.0-0               2.14.0-1
ii  libc6                     2.19-18+deb8u7
ii  libcairo2                 1.14.0-2.1+deb8u1
ii  libfontconfig1            2.11.0-6.3+deb8u1
ii  libfreetype6              2.5.2-3+deb8u1
ii  libgconf-2-4              3.2.6-3
ii  libgdk-pixbuf2.0-0        2.31.1-2+deb8u5
ii  libgksu2-0                2.0.13~pre1-8
ii  libglib2.0-0              2.42.1-1+b1
ii  libgnome-keyring0         3.12.0-1+b1
ii  libgtk2.0-0               2.24.25-3+deb8u1
ii  libpango-1.0-0            1.36.8-3
ii  libpangocairo-1.0-0       1.36.8-3
ii  libpangoft2-1.0-0         1.36.8-3
ii  libstartup-notification0  0.12-4
ii  sudo                      1.8.10p3-1+deb8u3

Versions of packages gksu recommends:
ii  gnome-keyring  3.14.0-1+b1

gksu suggests no packages.

-- no debconf information