SuSE Security Announcement – A problem exists in the Linux kernel 2.4 and 2.6 series where missing Discretionary Access Control (DAC) in the chown(2) system call allow an attacker with a local account the ability to change the group ownership of arbitrary files.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/33705/200420kernel.txt
Source: https://packetstormsecurity.com/files/33705/200420kernel.txt.html